CVE-2026-12297

Sandbox escape due to incorrect boundary conditions in the Networking component

CVSS 9.6 CRITICALEPSS 0.4%CWE-119 CWE-653

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.6EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

16 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Productos afectados

Mozilla · Firefox Mozilla · Thunderbird

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://access.redhat.com/errata/RHSA-2026:27717 https://access.redhat.com/errata/RHSA-2026:27733 https://access.redhat.com/errata/RHSA-2026:27734 https://access.redhat.com/errata/RHSA-2026:29940 https://access.redhat.com/errata/RHSA-2026:30846 https://access.redhat.com/errata/RHSA-2026:33445 https://access.redhat.com/security/cve/CVE-2026-12297 https://bugzilla.mozilla.org/show_bug.cgi?id=2041610 https://bugzilla.redhat.com/show_bug.cgi?id=2489235 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12297.json https://www.mozilla.org/security/advisories/mfsa2026-57/https://www.mozilla.org/security/advisories/mfsa2026-58/