CVE Catalog
CVE-2026-12294
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.36%
28th percentile — higher than 28% of all known CVEs
Summary
A sandbox escape vulnerability exists in the DOM: Workers component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Risk Assessment
An attacker could exploit this vulnerability to execute code outside the sandbox, potentially leading to system compromise or data theft.
Recommendation
Immediately update Firefox to version 152 or later, and Thunderbird to version 152 or 140.12. For ESR versions, apply updates to 140.12 or 115.37.
Original NVD description (English source)
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.