CVE-2026-16390
Mozilla FirefoxVulnerabilityCVSS 9.1Patched
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
No public exploitation has been reported so far. A fixed version is available (see the table below).
Recommended action: Update to the fixed version listed for your distribution using the native package manager.
Severity metrics
CVSS 3.1 : 9.1 CRITICAL
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
| Distribution | Package | Affected | Fixed version | Status |
|---|---|---|---|---|
| Debian:11 | firefox-esr | - | 140.13.0esr-1~deb11u1 | fixed |
| Debian:12 | firefox-esr | - | 140.13.0esr-1~deb12u1 | fixed |
| Debian:13 | firefox-esr | - | 140.13.0esr-1~deb13u1 | fixed |
| Debian:14 | firefox-esr | - | 140.13.0esr-1 | fixed |
| Debian:11 | thunderbird | - | - | affected (no fix yet) |
| Debian:12 | thunderbird | - | - | affected (no fix yet) |
| Debian:13 | thunderbird | - | - | affected (no fix yet) |
| Debian:14 | thunderbird | - | - | affected (no fix yet) |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| openSUSE:Tumbleweed | MozillaFirefox | - | 153.0-1.1 | fixed |
| openSUSE:Tumbleweed | MozillaThunderbird | - | 140.13.0-1.1 | fixed |
| openSUSE:Tumbleweed | firefox-esr | - | 140.13.0-1.1 | fixed |