CVE-2026-16390 is a mitigation bypass vulnerability affecting the Enterprise Policies component in Mozilla Firefox. It was fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability allows an attacker to bypass mitigation controls enforced by enterprise policies, which could reduce the effectiveness of security configurations in managed environments. The Mozilla advisory lists this vulnerability with moderate impact and confirms the fix in the stated versions. No active exploitation has been reported.

The vulnerability enables bypassing mitigation mechanisms in the Enterprise Policies component, which could allow attackers to circumvent security policies configured for enterprise environments. This may lead to reduced enforcement of security controls, potentially increasing the risk of further exploitation or policy violations. However, the impact is rated moderate by Mozilla, and no known exploits are currently active in the wild.

A fix is available and has been officially released by Mozilla. Users and administrators should update to Firefox 153 or later, or Firefox ESR 140.13 or later, to remediate this vulnerability. Applying these updates will restore the intended mitigation controls in the Enterprise Policies component and protect against this bypass issue.