CVE-2026-16377 is a mitigation bypass vulnerability affecting the PDF Viewer component in Mozilla Firefox. It was fixed in Firefox 153 and Firefox ESR 140.13 as part of Mozilla's security advisories MFSA 2026-68 and MFSA 2026-70. The vulnerability allows bypassing of security mitigations within the PDF Viewer, potentially weakening the security posture of the browser when handling PDF content. This fix was released alongside numerous other high and moderate impact vulnerabilities affecting Firefox components such as DOM, JavaScript engine, WebAssembly, and graphics subsystems. The vendor advisory does not report any active exploitation in the wild for this vulnerability.

The vulnerability could allow an attacker to bypass mitigation controls in the PDF Viewer component, potentially enabling further exploitation or unauthorized actions when processing PDF files. However, no active exploitation in the wild has been observed. The impact is considered moderate by Mozilla, indicating a significant but not critical risk if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 153 and Firefox ESR 140.13. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.