CVE-2026-12295

CriticalCVSS 9.6

Published: 16/06/2026(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile — higher than 31% of all known CVEs

Summary

A sandbox escape vulnerability exists in the DOM: Navigation component. This flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Risk Assessment

An attacker can exploit this vulnerability to break out of the browser's sandbox, potentially leading to arbitrary code execution outside the sandbox and system compromise.

Recommendation

Immediately update Firefox to version 152 or later, and ESR versions to 140.12 or 115.37. Also update Thunderbird to version 152 or 140.12.

Original NVD description (English source)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.