Cyber Resilience

CVE-2026-12297

CriticalUpdated

Published: 16 June 2026

Published
16 June 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0039 31.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-12297 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Sandbox escape via memory corruption (CWE-119) in browser networking component directly enables client-side code execution (T1203) and subsequent privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

mozilla
firefox
≤ 115.37.0 · ≤ 152.0.0 · 128.0 — 140.12.0
mozilla
thunderbird
≤ 140.12.0 · ≤ 152.0.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-653

Defines isolation boundaries by specifying which external systems may access or process organization data.

addresses: CWE-653

Maintains isolation and compartmentalization by restricting flows between security domains or levels.

addresses: CWE-653

Reviewing the continued need for connections supports isolation and compartmentalization.

addresses: CWE-653

Locating systems away from hazards improves isolation and compartmentalization from external physical or environmental threats.

addresses: CWE-653

The CONOPS must articulate isolation and compartmentalization expectations for security and privacy, making architectural failures in separation of duties or domains harder to overlook.

addresses: CWE-653

Security architectures commonly incorporate isolation and compartmentalization strategies to limit the impact of compromises.

addresses: CWE-653

Organization-wide privacy program leadership ensures proper isolation and compartmentalization of personal data.

addresses: CWE-653

Oversight ensures data-matching activities maintain required isolation between distinct data sets and authorized user communities.

References