CVE-2026-16380 is a mitigation bypass vulnerability located in the Networking component of Mozilla Firefox. The flaw allows attackers to circumvent existing security mitigations, which could lead to unauthorized access or manipulation of data. This vulnerability was resolved in Firefox 153. The CVSS 3.1 base score is 9.1 (critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory confirms the fix was implemented in Firefox 153.

The vulnerability allows an attacker to bypass mitigation controls in the Networking component, potentially leading to unauthorized disclosure and modification of information (high confidentiality and integrity impact). There is no impact on availability. The flaw can be exploited remotely without authentication or user interaction, increasing the risk. No known exploits in the wild have been reported at the time of advisory publication.

Mozilla has released an official fix for this vulnerability in Firefox version 153. Users and administrators should update affected Firefox installations to version 153 or later to remediate this issue. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory.