CVE-2026-16390: Firefox Auth Bypass Vulnerability

CVE-2026-16390 Overview

CVE-2026-16390 is a mitigation bypass vulnerability in the Enterprise Policies component of Mozilla Firefox and Thunderbird. The flaw is classified under [CWE-693] Protection Mechanism Failure, allowing attackers to circumvent security controls that administrators enforce through enterprise policy configurations. Mozilla addressed the issue in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

The vulnerability is reachable over the network without authentication or user interaction. Its impact affects confidentiality and integrity while leaving availability unaffected.

Critical Impact
An unauthenticated remote attacker can bypass Enterprise Policies protections, undermining administrator-defined restrictions on browser and mail client behavior.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Firefox ESR versions prior to 140.13
Mozilla Thunderbird versions prior to 153 and prior to 140.13

Discovery Timeline

2026-07-21 - CVE-2026-16390 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16390

Vulnerability Analysis

The vulnerability resides in the Enterprise Policies component used by Firefox and Thunderbird to enforce administrator-defined configuration. Enterprise Policies allow organizations to lock down features such as add-on installation, network access, telemetry, certificate handling, and content restrictions. A mitigation bypass in this component means that intended restrictions can be evaded by an attacker who can reach the client over the network.

Mozilla categorizes this issue under Protection Mechanism Failure [CWE-693]. The failure does not introduce direct memory corruption or code execution primitives. Instead, it weakens the boundary that separates administrator intent from web content or attacker-controlled input. As a result, functionality that administrators believe is disabled or restricted may remain accessible.

Mozilla published fixes in advisories MFSA-2026-68, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72.

Root Cause

The root cause is a failure of the Enterprise Policies enforcement logic to consistently apply configured restrictions across all execution paths. Technical detail is tracked in Mozilla Bug Report #2044527, which remains the authoritative source for the specific code paths affected.

Attack Vector

Exploitation occurs over the network with low complexity and requires no privileges or user interaction. An attacker delivers crafted content that a vulnerable Firefox or Thunderbird client processes, causing enterprise-configured mitigations to be bypassed. Confidentiality and integrity of policy-protected data and configuration are impacted, while availability remains intact.

No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication was 0.354%.

Detection Methods for CVE-2026-16390

Indicators of Compromise

Firefox or Thunderbird processes exhibiting behavior that contradicts deployed policies.json or Group Policy settings, such as loading blocked extensions or reaching restricted URLs.
Unexpected outbound network connections from browser or mail client processes to attacker-controlled domains despite policy restrictions.
Modification timestamps on policies.json, distribution/, or profile directories that do not correlate with authorized administrative changes.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the fleet and flag any endpoint running a build older than Firefox 153, Firefox ESR 140.13, or Thunderbird 140.13/153.
Compare enforced policy state on endpoints against the intended baseline by inspecting about:policies output collected through management tooling.
Correlate browser process telemetry with policy configuration to identify actions that should have been blocked by Enterprise Policies.

Monitoring Recommendations

Monitor endpoint process telemetry for child processes and network connections spawned by firefox.exe, firefox, or thunderbird that violate policy scope.
Alert on changes to Enterprise Policy configuration files and registry keys under HKLM\Software\Policies\Mozilla.
Track add-on installation events and extension load activity to detect deviations from the allow-list defined in policy.

How to Mitigate CVE-2026-16390

Immediate Actions Required

Upgrade all Firefox installations to version 153 or later, and Firefox ESR deployments to 140.13 or later.
Upgrade Thunderbird installations to 153 or to the 140.13 ESR build.
Validate that Enterprise Policies are re-applied after upgrade by reviewing about:policies#active on a sample of endpoints.
Prioritize patching for administrator, developer, and high-privilege user workstations where policy bypass has the largest blast radius.

Patch Information

Mozilla shipped fixes in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Refer to MFSA-2026-68, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72 for the advisories associated with each channel.

Workarounds

No vendor-supplied workaround replaces the patch; upgrading is required.
Reduce exposure by restricting network egress from client endpoints and enforcing DNS or web filtering that blocks known malicious infrastructure.
Layer additional compensating controls such as application allow-listing and browser isolation for high-risk users until patching completes.

bash

# Verify installed Firefox version on Linux/macOS endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# On Windows, query the installed version via registry
reg query "HKLM\Software\Mozilla\Mozilla Firefox" /v CurrentVersion