CVE-2026-16349 is a same-origin policy bypass vulnerability in the DOM Navigation component of Mozilla Firefox. This security flaw allows bypassing the same-origin policy, which is a fundamental web security mechanism designed to prevent scripts from one origin from accessing data in another origin. The vulnerability was addressed and fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix availability and notes no known exploitation in the wild. Multiple related security issues were also fixed in the same releases.

Successful exploitation of this vulnerability could allow an attacker to bypass the same-origin policy, potentially leading to unauthorized access to sensitive information, modification of data, and disruption of service within the affected Firefox versions. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. However, no active exploitation in the wild has been reported at this time.

A fix is available and has been released by Mozilla. Users and administrators should update affected Firefox versions to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13 or later to remediate this vulnerability. The vendor advisory does not indicate any additional mitigation steps or temporary workarounds. Applying the official update is the recommended action.