CVE-2026-8953CWE-416

CVE-2026-8953

Critical · published May 19, 2026

CVSS v3.1

9.6

EPSS

Percentile

38.6

In the wild

Unconfirmed

What it is

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

The record

Technical detail

CVSS v3.1: 9.6 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00456 · 38.6th percentile
Weakness: CWE-416 · Use After Free
Published: 2026-05-19T18:16Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 115.36.0	115.36.0
mozilla/firefox	< 151.0.0	151.0.0
mozilla/firefox	≥ 140.0, < 140.11.0	140.11.0
mozilla/thunderbird	< 140.11	140.11

References (6)

https://bugzilla.mozilla.org/show_bug.cgi?id=2029511 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-46/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-47/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-48/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-50/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-51/ · [email protected]

EPSS history

Timeline

19 MAY 12:29Z
Sandbox escape due to use-after-free in the Disability Access APIs component
cvelistv5