Sandbox Escape Vulnerability in Firefox Navigation Component
CVE-2026-12295

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
16 June 2026

What is CVE-2026-12295?

A sandbox escape vulnerability exists in the navigation component of Firefox, which could potentially allow attackers to circumvent security restrictions and execute unauthorized scripts. This type of vulnerability may compromise user data and system integrity. Mozilla has addressed this issue in specific updates, notably in Firefox versions 152, ESR 140.12, and ESR 115.37, ensuring enhanced security for users.

Affected Version(s)

Firefox 115.37

Firefox 140.12

Firefox 152

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2040160
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqoub Aldurayhim
.