Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:NSummary
CVE-2026-16404 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Mozilla Firefox Mobile. Its CVSS base score is 7.4 (High).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-46242
Vulnerability Data
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 3 hardening rules · 3 OS baselines
V6.4.3V10.4.16V10.5.1V11.4.3
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the Firefox for Android flaw that enabled the CWE-290 spoofing bypass.
Enforces access decisions only after proper authentication, blocking spoofed identities that the vulnerability exploited.
Mandates identification and authentication mechanisms that would have rejected the spoofed credentials or tokens used in the attack.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.
Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.
Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication control directly mitigates authentication bypass by spoofing.
Authentication information management directly addresses credential handling that prevents spoofing.
Security testing can detect spoofing vulnerabilities but does not prevent them by itself.
Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.
Identity management supports unique identities but does not guarantee resistance to spoofing.
Access rights assignment limits exposure but does not enforce authentication strength.