Firefox 153 fixes sandbox escapes and memory flaws

Mozilla released Firefox 153 on 21 July 2026 with a large security advisory covering high-impact flaws across browser isolation, navigation, WebRTC, WebAssembly, JavaScript JIT, graphics, media, accessibility APIs, and memory safety. Enterprise support branches were updated at the same time to Firefox ESR 140.13 and Firefox ESR 115.38.

Mozilla rates the Firefox 153 advisory as high impact. The Canadian Centre for Cyber Security separately highlighted the releases and encouraged administrators to apply the updates. Mozilla's advisory does not state that these newly disclosed Firefox 153 vulnerabilities are being exploited in the wild, so the correct message is urgent risk reduction — not an unsupported zero-day claim.

The most important classes of fix

Several high-impact entries sit directly on security boundaries that a browser uses to contain hostile web content:

Sandbox escapes: CVE-2026-16351 affects DOM navigation; CVE-2026-16352, CVE-2026-16356, and CVE-2026-16367 affect accessibility APIs. Mozilla describes use-after-free or invalid-pointer conditions in these cases.
Origin and privilege boundaries: CVE-2026-16349 is a same-origin policy bypass, while CVE-2026-16365 and CVE-2026-16366 are privilege-escalation issues in workers and navigation.
WebAssembly and JavaScript: CVE-2026-16363 is a WebAssembly JIT miscompilation; CVE-2026-16368 and CVE-2026-16369 involve boundary handling and integer overflow; CVE-2026-16355 affects the JavaScript JIT.
Media and communications: CVE-2026-16362 is a WebRTC use-after-free, with additional high-impact boundary issues in audio, video, and playback components.
Memory safety: Mozilla grouped further bugs under CVE-2026-16411, CVE-2026-16412, and CVE-2026-16360. The advisory says some showed evidence of memory corruption and could potentially be developed into arbitrary-code execution with enough effort.

These entries should not be read as one ready-made exploit chain. They are separate vulnerabilities fixed in the same release. Their concentration around isolation and memory safety is still a strong reason to shorten the browser rollout window.

Which versions should be deployed

Rapid release: Firefox 153 or later.
Current ESR: Firefox ESR 140.13 or later.
Legacy ESR 115: Firefox ESR 115.38 or later where that branch remains applicable.

Choose the target according to Mozilla's supported channel for the device; do not migrate between rapid release and ESR blindly. The immediate control is to bring each installed channel to its fixed build.

The browser must restart before the risk is gone

Downloading an update is not the same as running it. Long-lived browser sessions, suspended laptops, virtual desktops, kiosk devices, and developer workstations can retain the old process for days. Enterprise rollout should measure the active browser version after restart, not merely report that a package was assigned.

Inventory Firefox across operating-system packages, Mozilla installers, Microsoft Store deployments, managed Linux formats, VDI images, CI test runners, and portable or developer installations.
Deploy the correct fixed channel, prompt users to restart, and define a deadline for enforcing that restart where operationally safe.
Verify from application telemetry, software inventory, or Firefox's troubleshooting information that the running process is 153, ESR 140.13, or ESR 115.38 as appropriate.
Investigate devices that do not converge: update policies, file locks, broken repositories, frozen VDI images, insufficient disk space, and unsupported operating systems are common causes.

Why this matters for EU security governance

NIS2 Article 21 requires covered organisations to take appropriate and proportionate cybersecurity risk-management measures, including security in the acquisition, development, and maintenance of systems and policies for assessing the effectiveness of controls. It does not prescribe a universal “patch every browser within X hours” rule. A defensible process should nevertheless be able to show inventory, risk-based prioritisation, deployment, exception handling, and verification.

Browser patch telemetry is useful evidence because it closes the gap between policy and operation. “Automatic updates enabled” describes an intention; a report of active fixed versions demonstrates the result.

Browsers sit next to your most valuable credentials

A browser processes untrusted content while holding authenticated sessions for email, cloud consoles, ticketing, source control, and identity systems. That combination makes isolation failures particularly important even when public exploitation has not been reported. Reduce exposure further with phishing-resistant authentication, extension allowlists, least-privilege administration, and short-lived sessions for sensitive services.

If a device shows signs of browser compromise, updating it is only the first step. Isolate and investigate the host, invalidate relevant sessions, and rotate credentials that may have been exposed rather than assuming the new binary reverses activity that already occurred.