CVE-2026-16401 is a high-severity privilege escalation vulnerability affecting the Data Loss Prevention component in Mozilla Firefox and Thunderbird. This vulnerability allows an attacker to escalate privileges within the application context. It affects all versions prior to 153 and was addressed by Mozilla in Firefox 153 and Thunderbird 153. The vulnerability is part of a larger set of security fixes released simultaneously, as documented in Mozilla Foundation Security Advisories 2026-68 and 2026-71. No active exploitation has been reported. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within Firefox or Thunderbird, potentially leading to unauthorized actions or access within the application. Given the high CVSS score and the nature of privilege escalation, the impact is considered high. However, there are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 153 and Thunderbird 153. Users and administrators should update affected products to version 153 or later to remediate this issue. Since the vulnerability is fixed in these versions, no additional mitigation steps are required beyond applying the official update.