CVE-2026-12315
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability involving a mitigation bypass in the DOM security component. It was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to bypass application security. This could lead to unauthorized access to user data.
Recommendation
It is recommended to update to the latest versions of Firefox and Thunderbird to mitigate this vulnerability.
Other vulnerabilities in DOM security component
See all- CVE-2026-12316Critical
Mitigation bypass in the DOM security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
- CVE-2026-12302Medium
The vulnerability involves a mitigation bypass in the DOM security component. It was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Original NVD description (English source)
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS