Description
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Published: 2026-06-16
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an attacker to escape the process sandbox enforced by Mozilla applications, potentially enabling the execution of arbitrary code outside the sandbox.

Affected Systems

Mozilla Firefox versions prior to 152 and prior to 152 and ESR 140.12 are affected. Both desktop browsers and email clients share the same vulnerable sandboxing component.

Risk and Exploitability

The EPSS score indicates a very low current exploitation probability (<1%), and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is most likely local, potentially involving a malicious document or script executed within the affected application; however, the CVE description does not explicitly state this. The CVSS score of 9.6 highlights the critical severity of this vulnerability.

Generated by OpenCVE AI on June 18, 2026 at 22:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch by upgrading to Firefox 152 or later, or ESR 140.12 or later.
  • Apply the vendor patch by upgrading to Thunderbird 152 or later, or ESR 140.12 or later.
  • Enable automatic updates for Firefox and Thunderbird to ensure timely receipt of future security fixes.

Generated by OpenCVE AI on June 18, 2026 at 22:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4635-1 firefox-esr security update
Debian DLA Debian DLA DLA-4636-1 thunderbird security update
Debian DSA Debian DSA DSA-6350-1 firefox-esr security update
Debian DSA Debian DSA DSA-6351-1 thunderbird security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:27717 cve-icon
https://access.redhat.com/errata/RHSA-2026:27733 cve-icon
https://access.redhat.com/errata/RHSA-2026:27734 cve-icon
https://access.redhat.com/errata/RHSA-2026:29940 cve-icon
https://access.redhat.com/errata/RHSA-2026:30846 cve-icon
https://access.redhat.com/errata/RHSA-2026:33445 cve-icon
https://access.redhat.com/errata/RHSA-2026:36100 cve-icon
https://access.redhat.com/errata/RHSA-2026:36101 cve-icon
https://access.redhat.com/errata/RHSA-2026:36102 cve-icon
https://access.redhat.com/errata/RHSA-2026:36103 cve-icon
https://access.redhat.com/errata/RHSA-2026:37210 cve-icon
https://access.redhat.com/errata/RHSA-2026:37391 cve-icon
https://access.redhat.com/errata/RHSA-2026:38506 cve-icon
https://access.redhat.com/errata/RHSA-2026:38750 cve-icon
https://access.redhat.com/errata/RHSA-2026:38751 cve-icon
https://access.redhat.com/errata/RHSA-2026:38753 cve-icon
https://access.redhat.com/errata/RHSA-2026:39011 cve-icon
https://access.redhat.com/errata/RHSA-2026:39141 cve-icon
https://access.redhat.com/errata/RHSA-2026:39142 cve-icon
https://access.redhat.com/errata/RHSA-2026:39428 cve-icon
https://access.redhat.com/errata/RHSA-2026:39706 cve-icon
https://access.redhat.com/security/cve/CVE-2026-12296 cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=2040515 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2489232 cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-12296 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12296.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-12296 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-57/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12296 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-60/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12296 cve-icon
History

Thu, 18 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-272

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-403
CWE-693
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

threat_severity

Important

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-272

Tue, 16 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12. Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
References

Tue, 16 Jun 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 16 Jun 2026 13:15:00 +0000

Type Values Removed Values Added
Description Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Title Sandbox escape in the Security: Process Sandboxing component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-15T11:48:21.627Z

Reserved: 2026-06-15T15:08:08.752Z

Link: CVE-2026-12296

cve-icon Vulnrichment

Updated: 2026-07-15T11:48:21.627Z

cve-icon NVD

Status : Modified

Published: 2026-06-16T13:16:29.833

Modified: 2026-07-15T12:17:05.973

Link: CVE-2026-12296

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-16T11:52:29Z

Links: CVE-2026-12296 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T22:45:16Z

Weaknesses
  • CWE-403

    Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

  • CWE-693

    Protection Mechanism Failure