CVE-2026-12315

Mitigation bypass in the DOM: Security component

Published Jun 16, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Analysis

Technical impact

This vulnerability enables the bypass of the DOM security component in Mozilla products. The impact is that the protection mechanisms meant to guard against malicious DOM manipulation can be circumvented, exposing the system to further compromise. The weakness is classified as CWE-693 and CWE-807, indicating improper authorization and related restrictions.

Affected Systems

The bug affects Mozilla Firefox and Mozilla Thunderbird versions prior to Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12. Users running earlier versions are vulnerable.

Risk and Exploitability

The CVSS score of 9.1 indicates a high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation today. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is likely remote, involving malicious web content or email attachments that manipulate the DOM. If exploited, the attacker could override security checks, potentially leading to code execution or other privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.12`	unaffected	≤ 140.*
`152`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[140.12,140.*]`	unaffected	generic	—
`[152,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox ESR 140.12 or newer).
Upgrade Mozilla Thunderbird to version 152 or newer (or ESR 140.12 or newer).
If an immediate upgrade is not feasible, consider disabling or limiting script execution in browser settings as a temporary measure until the patch is applied.

Generated by OpenCVE AI on June 18, 2026 at 18:23 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4635-1	firefox-esr security update
Debian DLA	DLA-4636-1	thunderbird security update
Debian DSA	DSA-6350-1	firefox-esr security update
Debian DSA	DSA-6351-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2042058
https://nvd.nist.gov/vuln/detail/CVE-2026-12315
https://www.cve.org/CVERecord?id=CVE-2026-12315
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-58/
https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12315
https://www.mozilla.org/security/advisories/mfsa2026-60/
https://www.mozilla.org/security/advisories/mfsa2026-61/
https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12315

History

Jun 18, 2026 4:45 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-807
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12315 https://www.cve.org/CVERecord?id=CVE-2026-12315 https://www.mozilla.org/security/advisories/mfsa2026-58/#CVE-2026-12315 https://www.mozilla.org/security/advisories/mfsa2026-61/#CVE-2026-12315
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 16, 2026 8:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 4:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
References		https://www.mozilla.org/security/advisories/mfsa2026-60/ https://www.mozilla.org/security/advisories/mfsa2026-61/

Jun 16, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Jun 16, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Title		Mitigation bypass in the DOM: Security component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2042058 https://www.mozilla.org/security/advisories/mfsa2026-57/ https://www.mozilla.org/security/advisories/mfsa2026-58/