CVE-2026-16349 is a vulnerability in Mozilla Firefox's DOM Navigation component that allows bypassing the same-origin policy. This policy is fundamental to web security, preventing scripts from one origin from accessing data from another. The flaw was addressed and fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Mozilla's official advisories confirm the fix and classify the impact as high. There is no CVSS score available, but the vendor's impact rating and the nature of the vulnerability indicate a serious security concern. No active exploitation has been observed.

The vulnerability enables bypassing the same-origin policy, potentially allowing malicious web content to access or manipulate data from other origins, which could lead to unauthorized data access or actions within the browser context. This undermines a core security boundary in web browsers, increasing the risk of cross-origin attacks.

Mozilla has released official fixes for this vulnerability in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official patches.