CVE-2026-16390 is a vulnerability in Mozilla Firefox's Enterprise Policies component that enables an attacker to bypass mitigation controls. This flaw was resolved in Firefox 153 and Firefox ESR 140.13. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning it can be exploited remotely without authentication or user interaction, resulting in high confidentiality and integrity impact. The vendor advisory confirms the fix availability in the specified versions. There are no known exploits in the wild at the time of the advisory.

Successful exploitation of this vulnerability could allow an attacker to bypass enterprise policy mitigations, potentially leading to unauthorized changes in browser configuration or security settings. This could compromise the confidentiality and integrity of user data or browser behavior. The CVSS score of 9.1 reflects a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Mozilla has released official fixes for this vulnerability in Firefox 153 and Firefox ESR 140.13. Users and organizations should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory. There are no indications that additional mitigations or workarounds are necessary beyond updating.