CVE-2026-12297

Sandbox escape due to incorrect boundary conditions in the Networking component

View on CVE.org
Published Jun 16, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Analysis

AI-generated

Technical impact

The vulnerability arises from incorrect boundary checks in the Networking component, which can cause a sandbox escape and allow an attacker to execute code with elevated privileges. This flaw directly threatens the integrity and confidentiality of the affected system by granting the attacker the ability to run arbitrary code.

Affected Systems

Mozilla products that are impacted include Firefox and Thunderbird versions older than 152. The fix was delivered in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, as well as in Thunderbird 152 and Thunderbird ESR 140.12. The issue is confined to the Networking component of these browsers and does not affect later releases.

Risk and Exploitability

The EPSS score of less than 1 % denotes a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves processing untrusted network content, such as visiting a malicious website or opening an infected email attachment; once this boundary error is triggered, the sandbox can be bypassed and arbitrary code may run. The CVSS score of 9.6 indicates a critical severity.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest version of Firefox or Thunderbird that contains the fix (e.g., Firefox 152 or ESR 140.12/115.37, Thunderbird 152 or ESR 140.12).
  • Configure the browser’s security settings to a higher level or enable strict sandboxing to prevent untrusted network content from executing before the fix is applied.
  • Continuously monitor Mozilla security advisories and apply subsequent patches promptly.

Generated by OpenCVE AI on June 18, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4635-1 firefox-esr security update
Debian DLA Debian DLA DLA-4636-1 thunderbird security update
Debian DSA Debian DSA DSA-6350-1 firefox-esr security update
Debian DSA Debian DSA DSA-6351-1 thunderbird security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:27717 cve-icon
https://access.redhat.com/errata/RHSA-2026:27733 cve-icon
https://access.redhat.com/errata/RHSA-2026:27734 cve-icon
https://access.redhat.com/errata/RHSA-2026:29940 cve-icon
https://access.redhat.com/errata/RHSA-2026:30846 cve-icon
https://access.redhat.com/errata/RHSA-2026:33445 cve-icon
https://access.redhat.com/errata/RHSA-2026:36100 cve-icon
https://access.redhat.com/errata/RHSA-2026:36101 cve-icon
https://access.redhat.com/errata/RHSA-2026:36102 cve-icon
https://access.redhat.com/errata/RHSA-2026:36103 cve-icon
https://access.redhat.com/errata/RHSA-2026:37210 cve-icon
https://access.redhat.com/errata/RHSA-2026:37391 cve-icon
https://access.redhat.com/errata/RHSA-2026:38506 cve-icon
https://access.redhat.com/errata/RHSA-2026:38750 cve-icon
https://access.redhat.com/errata/RHSA-2026:38751 cve-icon
https://access.redhat.com/errata/RHSA-2026:38753 cve-icon
https://access.redhat.com/errata/RHSA-2026:39011 cve-icon
https://access.redhat.com/errata/RHSA-2026:39141 cve-icon
https://access.redhat.com/errata/RHSA-2026:39142 cve-icon
https://access.redhat.com/errata/RHSA-2026:39428 cve-icon
https://access.redhat.com/errata/RHSA-2026:39706 cve-icon
https://access.redhat.com/security/cve/CVE-2026-12297 cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=2041610 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2489235 cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-12297 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12297.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-12297 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-57/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12297 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-59/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-60/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12297 cve-icon
History
Type Values Removed Values Added
Weaknesses CWE-119
CWE-653
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

threat_severity

Important
Type Values Removed Values Added
Description Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
References
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
Description Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37.
Title Sandbox escape due to incorrect boundary conditions in the Networking component
References
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-653

    Improper Isolation or Compartmentalization

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jul 15, 2026, 11:48 AM
Reserved
Jun 15, 2026, 3:08 PM

View source JSON

Updated
Jul 15, 2026, 11:48 AM

JSON

Status
Modified
Published
Jun 16, 2026, 1:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

Severity
Important
Public date
Jun 16, 2026, 11:52 AM

View source Bugzilla JSON

Updated
Jun 18, 2026, 6:15 PM

JSON