CVE-2026-12302

A flaw in the DOM security component allows an attacker to bypass built‑in mitigations that guard against malicious code execution and data leakage. The weakness originates from a misconfiguration or incorrect enforcement of security controls (CWE‑693). If successfully exploited, an attacker could run arbitrary scripts with the privileges of the user’s browser session, potentially accessing local data or executing higher‑privileged code in a compromised system.

Mozilla Firefox and Thunderbird are impacted. All releases prior to Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 are vulnerable. Updated binaries released after these version thresholds contain the remediation.

The CVSS score of 6.5 indicates a moderate to high severity. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a crafted web page or email message that is processed by the browser’s DOM, requiring local user interaction or the ability to load the malicious content. Because the flaw is a misconfiguration, it does not necessarily allow remote code execution without the user’s involvement, but once bypassed the attacker can gain significant inline control.