CVE-2026-12294

CriticalCVSS 9.6

Published: 16/06/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

A sandbox escape vulnerability exists in the DOM: Workers component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Risk Assessment

An attacker could exploit this vulnerability to execute code outside the sandbox, potentially leading to system compromise or data theft.

Recommendation

Immediately update Firefox and Thunderbird to the latest versions listed in the advisory.

Original NVD description (English source)

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.