CVE-2026-16356: Mozilla Firefox Use-After-Free in Accessibility APIs

HERMES

HERMES THREAT SCORE & ACCESSIBILITY SUBSYSTEM UAF

Target: Mozilla Firefox Accessibility Subsystem (AccessibleHandler / IA2)

Confidence: 98%

91 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 17 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-16356 at Critical severity (HTS 91). Accessibility subsystems cross process sandboxing boundaries because screen readers and assistive tech require elevated IPC access, making Use-After-Free flaws prime candidates for browser sandbox escapes.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-16356: Mozilla Firefox Use-After-Free in Accessibility APIsVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Use-After-Free in Disability Access APIs

CVSS v3.1: 8.8 High / 9.1 Adjusted (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) / CWE-416: Use After Free.
Disclosed by Mozilla. A use-after-free vulnerability in the Disability Access API handler allows an attacker who persuades a user to visit a crafted web page to trigger heap corruption and achieve sandbox escape. Addressed in Firefox 153, Firefox ESR 140.13, and Firefox ESR 115.38.

Executive Summary

Mozilla published security fixes for CVE-2026-16356, an accessibility subsystem flaw.

During the destruction of accessible DOM nodes, an active assistive technology query could maintain a dangling pointer to freed accessible objects, facilitating arbitrary code execution in privileged browser contexts.

---

1. Metadata & Remediation

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-16356	Standardized vulnerability identifier
Affected Subsystem	Disability Access APIs	Assistive technology interface
Fixed Releases	Firefox 153, Firefox ESR 140.13, ESR 115.38	Vendor security release
Associated CWE	CWE-416: Use After Free	Heap memory corruption

1. Apply Browser Upgrade: Upgrade to Firefox 153 or Firefox ESR 140.13.
2. Review Assistive Tools: Audit third-party software leveraging Windows IAccessible2 or Linux AT-SPI.