CVE-2026-12293

Use-after-free in the Graphics: WebGPU component

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12295

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12291

Use-after-free in the Networking: HTTP component

Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12294

Sandbox escape in the DOM: Workers component

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12296

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12322

Clickjacking issue in the Widget: Gtk component

Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12292

Incorrect boundary conditions in the Web Audio component

Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12297

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12326

Memory safety bugs fixed in Firefox 152 and Thunderbird 152

Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12327

Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12299

JIT miscompilation in the DOM: Core & HTML component

JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12302

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12303

Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component

Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12313

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12318

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12319

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12321

JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12325

Denial-of-service in the Graphics: ImageLib component

Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12304

Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-12311

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird