Cyber Resilience

CVE-2026-12295

CriticalUpdated

Published: 16 June 2026

Published
16 June 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0039 31.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-12295 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Why these techniques?

Direct sandbox escape in browser DOM/navigation enables escape to host.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

mozilla
firefox
≤ 115.37.0 · ≤ 152.0.0 · 128.0 — 140.12.0
mozilla
thunderbird
≤ 140.12.0 · ≤ 152.0.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-653 CWE-693

The CONOPS must articulate isolation and compartmentalization expectations for security and privacy, making architectural failures in separation of duties or domains harder to overlook.

addresses: CWE-653 CWE-693

Security architectures commonly incorporate isolation and compartmentalization strategies to limit the impact of compromises.

addresses: CWE-653 CWE-693

Organization-wide privacy program leadership ensures proper isolation and compartmentalization of personal data.

addresses: CWE-653 CWE-693

Architecture explicitly designs isolation, segmentation, and compartmentalization (e.g., networks, data flows), preventing improper isolation weaknesses.

addresses: CWE-653 CWE-693

Requires the architecture to show how functions work together as a unified protection approach, reducing improper isolation or compartmentalization.

addresses: CWE-653 CWE-693

Isolation and compartmentalization techniques are core to tamper resistance, limiting an attacker's ability to reach or alter protected components.

addresses: CWE-693 CWE-653

Mandates selection and application of resiliency techniques and implementation approaches that strengthen protection mechanisms against failure or bypass.

addresses: CWE-653 CWE-693

Separation-of-privilege and least-common-mechanism principles enforce proper isolation.

References