CVE-2026-12295
Published: 16 June 2026
Summary
CVE-2026-12295 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-37086
Vulnerability details
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct sandbox escape in browser DOM/navigation enables escape to host.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The CONOPS must articulate isolation and compartmentalization expectations for security and privacy, making architectural failures in separation of duties or domains harder to overlook.
Security architectures commonly incorporate isolation and compartmentalization strategies to limit the impact of compromises.
Organization-wide privacy program leadership ensures proper isolation and compartmentalization of personal data.
Architecture explicitly designs isolation, segmentation, and compartmentalization (e.g., networks, data flows), preventing improper isolation weaknesses.
Requires the architecture to show how functions work together as a unified protection approach, reducing improper isolation or compartmentalization.
Isolation and compartmentalization techniques are core to tamper resistance, limiting an attacker's ability to reach or alter protected components.
Mandates selection and application of resiliency techniques and implementation approaches that strengthen protection mechanisms against failure or bypass.
Separation-of-privilege and least-common-mechanism principles enforce proper isolation.