CVE-2026-12295
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A sandbox escape vulnerability exists in the DOM: Navigation component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Risk Assessment
An attacker can exploit this vulnerability to break out of the browser sandbox, potentially leading to arbitrary code execution on the underlying operating system and full compromise of the victim's device.
Recommendation
Immediately update Firefox to version 152 or later, and ESR versions to 140.12 or 115.37. Also update Thunderbird to version 152 or 140.12.
Original NVD description (English source)
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.