Sandbox Escape Vulnerability in Mozilla Firefox and ESR Versions
CVE-2026-12297

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
16 June 2026

What is CVE-2026-12297?

A potential sandbox escape was discovered in the Networking component of Mozilla Firefox, caused by incorrect boundary conditions. This vulnerability allows for unintended data leakage and could enable attackers to execute certain operations outside the rigorously defined sandbox environment. Mozilla has addressed this issue by releasing updates in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, enhancing the security integrity of the affected products.

Affected Version(s)

Firefox 115.37

Firefox 140.12

Firefox 152

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2041610
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zx
.