CVE-2026-16377 is a mitigation bypass vulnerability affecting the PDF Viewer component in Mozilla Firefox. This vulnerability allows an attacker to circumvent implemented security mitigations. It was addressed and fixed in Firefox 153 and Firefox ESR 140.13. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and provides detailed references to the bug report. No active exploitation has been observed.

Successful exploitation of this vulnerability could allow an attacker to bypass security mitigations in the PDF Viewer component, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of mitigation bypass, this represents a high risk to users running affected versions of Firefox.

Mozilla has released official fixes for this vulnerability in Firefox 153 and Firefox ESR 140.13. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation actions are required beyond applying the official updates.