CVE-2026-12297
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A sandbox escape vulnerability exists in the Networking component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Risk Assessment
An attacker can exploit this vulnerability to break out of the sandbox, potentially leading to privilege escalation and full system compromise.
Recommendation
Immediately update Firefox and Thunderbird to the patched versions (Firefox 152, ESR 140.12/115.37, Thunderbird 152/140.12).
Original NVD description (English source)
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.