CVE-2026-12297

Sandbox escape due to incorrect boundary conditions in the Networking component

CVSS 9.6 CRITICALEPSS 0.4%CWE-119 CWE-653

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.6EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

16 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Mozilla · Firefox Mozilla · Thunderbird

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://access.redhat.com/errata/RHSA-2026:27717 https://access.redhat.com/errata/RHSA-2026:27733 https://access.redhat.com/errata/RHSA-2026:27734 https://access.redhat.com/errata/RHSA-2026:29940 https://access.redhat.com/errata/RHSA-2026:30846 https://access.redhat.com/errata/RHSA-2026:33445 https://access.redhat.com/security/cve/CVE-2026-12297 https://bugzilla.mozilla.org/show_bug.cgi?id=2041610 https://bugzilla.redhat.com/show_bug.cgi?id=2489235 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12297.json https://www.mozilla.org/security/advisories/mfsa2026-57/https://www.mozilla.org/security/advisories/mfsa2026-58/