diff --git a/firefox.spec b/firefox.spec
index 443e5bd1dd04a0cad2a0befda44a1dc046c1ccfe..936278b7a88097b2aebfb1faac8135ce96dd9051 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -68,11 +68,11 @@
 %global __provides_exclude_from ^%{mozappdir}
 %global __requires_exclude ^(%%(find %{buildroot}%{mozappdir} -name '*.so' | xargs -n1 basename | sort -u | paste -s -d '|' -))
 
-%global langpacks_date 20260902
+%global langpacks_date 20260922
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        140.15.0
+Version:        140.16.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -768,6 +768,17 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 %{_datadir}/applications/firefox-x11.desktop
 
 %changelog
+* Tue Sep 22 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 140.16.0-1
+- [Type] security
+- [DESC] Update to 140.16.0esr (MFSA2026-92), fixes all 28 CVEs:
+- CVE-2026-92005, CVE-2026-92006, CVE-2026-92007, CVE-2026-92008,
+- CVE-2026-92009, CVE-2026-92010, CVE-2026-92011, CVE-2026-92012,
+- CVE-2026-92013, CVE-2026-92014, CVE-2026-92015, CVE-2026-92016,
+- CVE-2026-92017, CVE-2026-92018, CVE-2026-92019, CVE-2026-92020,
+- CVE-2026-92021, CVE-2026-92022, CVE-2026-92023, CVE-2026-92024,
+- CVE-2026-92025, CVE-2026-92026, CVE-2026-92027, CVE-2026-92028,
+- CVE-2026-92029, CVE-2026-92030, CVE-2026-92031, CVE-2026-92032
+
 * Wed Sep 02 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 140.15.0-1
 - [Type] security
 - [DESC] Update to 140.15.0esr, fixes all Linux CVEs from ESR 140.14 and 140.15:
diff --git a/sources b/sources
index 3d333ae8a71c18057dfe0be945aa056e279f1d77..ed84139dc652fb20699c9e1cc51525813e3960ad 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (cbindgen-vendor.tar.xz) = 17b4bdb05f21917b11b78e086ebb4e7d7cc28c046ba3267c7be45380fe3e0a24a2722d71f70423365dd152beff198f8f4f41660a12cfb89c8806d2781bdfeb87
-SHA512 (firefox-langpacks-140.15.0esr-20260902.tar.xz) = 078fe6298aa5be1f178a7aec7d692e9a330bff9618b0fec4b7d93d9b5df28286cc6341174d3b614b7a178755d5f4b016ea267eb7b6fb07f3431d90ba4381a59c
-SHA512 (firefox-140.15.0esr.processed-source.tar.xz) = 434a631a3dcb174bf7610b42ab879036bb9814d53cc0482c2f0bdf5f519758ea3afad882c7ae397263fd6fb2084f677cb79542c424078f1add4accd63748084a
+SHA512 (firefox-langpacks-140.16.0esr-20260922.tar.xz) = 9e552a180dd88cd32b9bc5052133551e34b4f8c092f67169eeceae898afbb448354f2305d1d431cb409c2ecb54cd01a660f3a778ae06ad8bfacf93f53d57d38b
+SHA512 (firefox-140.16.0esr.processed-source.tar.xz) = b3a06afc4678e7ade1acec023386f0fa429ced0d567b2b4852d3d0b1b7871f8a6b7f585c83d1e586fdee772f0fa84940377e4cb80599a9780e571e57830b6148