Mozilla Firefox: Mitigation bypass in the Enterprise Policies component
Summary
Mozilla's Enterprise Policies component, the administrator mechanism for locking down Firefox and Thunderbird settings, can be bypassed. The CVE record and Mozilla's advisory give few technical details, and the exact bypassed control is not described in the sources reviewed. Mozilla rates the issue moderate, while the CVSS 8.1 score in the record is not yet confirmed against NVD and other sources report lower scores (VulDB 6.3). Exploitation requires user interaction, and the attacker could affect confidentiality and integrity.
Affected
- Firefox before 158 and Firefox ESR before 153.5 (SUSE data via third-party tracker; not confirmed in Mozilla's own text)
- Thunderbird before 158 and Thunderbird 153.5 (exact affected range not confirmed)
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Workaround
No workaround documented. Updating is the remedy.
Exploitation
- Not known to be exploited. CISA SSVC: exploitation none, automatable no.
- No public proof-of-concept found in the sources reviewed (third-party trackers only).
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the fixed versions via your managed update channel.
- Verify deployed versions in your inventory, as ESR and distribution packages may lag.
- Review Enterprise Policies as a security control, since a bypass undermines it, and monitor Bugzilla 2044525 for details.
- Treat the vendor rating (moderate) as the basis for prioritisation, and use the CVSS 8.1 score only with the caveat that it is not confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-106 (en-US) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
- Mozilla Bugzilla bug 2044525 bugzilla.mozilla.org
- VulDB entry 417592 vuldb.com
- Ubuntu CVE tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:51.
Original description (NVD)
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.