Cyber Resilience

CVE-2026-12294

CriticalUpdated

Published: 16 June 2026

Published
16 June 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0036 28.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-12294 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Why these techniques?

Explicit sandbox escape in browser DOM/Workers directly enables Escape to Host.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

mozilla
firefox
≤ 115.37.0 · ≤ 152.0.0 · 128.0 — 140.12.0
mozilla
thunderbird
≤ 140.12.0 · ≤ 152.0.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-266

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

addresses: CWE-693

Implements a reliable, tamperproof protection mechanism whose completeness can be assured.

addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

addresses: CWE-266

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

addresses: CWE-693

Procedures for training on protection mechanisms reduce the chance of protection mechanism failures being present or exploitable.

addresses: CWE-693

Documented procedures to implement assessment, authorization, and monitoring controls prevent these protection mechanisms from failing due to undefined processes.

References