CVE-2026-16363
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Jul 21, 2026
CISA due date
—
The record
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115786 A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an… CWE-682
- CVE-2026-106438 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept… CWE-682
- CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
- CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
- CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
- CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-682
- CVE-2026-76043 Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote… CWE-682
- CVE-2026-71479 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset… CWE-682