CVE-2026-12299
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk22th percentile — higher than 22% of all known CVEs
Summary
A JIT miscompilation vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Risk Assessment
An attacker could exploit the incorrect JIT compilation to achieve remote code execution or data integrity compromise in the browser or mail client, threatening confidentiality and availability.
Recommendation
Immediately update Firefox to version 152 or later (or the appropriate ESR version) and Thunderbird to version 152 or 140.12.
Original NVD description (English source)
JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.