Cyber Resilience

CVE-2026-12299

Memory Safety in Mozilla Firefox ≤ 115.37.0

Memory Safety
Published
16 June 2026
Modified
15 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0031 23th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-12299 is a medium-severity Type Confusion (CWE-843) vulnerability in Mozilla Firefox. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CWE(s)
CWE-843CWE-733

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

JIT type confusion in browser DOM enables drive-by client-side code execution via malicious web content.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2796Same product: Mozilla Firefox
CVE-2026-12298Same product: Mozilla Firefox
CVE-2026-2790Same product: Mozilla Firefox
CVE-2026-2781Same product: Mozilla Firefox
CVE-2026-2762Same product: Mozilla Firefox
CVE-2026-12291Same product: Mozilla Firefox
CVE-2026-16399Same product: Mozilla Firefox
CVE-2026-10702Same product: Mozilla Firefox
CVE-2026-2772Same product: Mozilla Firefox
CVE-2026-2785Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 115.37.0 · ≤ 152.0 · 140.0 — 140.12.0
mozilla
thunderbird
≤ 152.0.0 · 140.0 — 140.12.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.5.2
  • V3.2.3
  • V15.3.5

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely application of the vendor-supplied patches that remediate the JIT miscompilation flaw in Firefox/Thunderbird.

CM-7 Least Functionality partial match
prevent

Enforces least functionality by disabling or restricting JIT compilation and high-risk DOM features that the vulnerability exploits.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Requires integrity verification of browser binaries and JIT-generated code to detect unauthorized modification resulting from the type-confusion flaw.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent type-confusion flaws via safe typing, static analysis, and code review while the control itself addresses many additional weaknesses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect type-confusion vulnerabilities through fuzzing and static analysis.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates type-safe design and review that can catch type-confusion flaws.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify strong typing and interface contracts that reduce type confusion.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles promote type-safe languages and memory-safety mechanisms that mitigate type confusion.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly forbid unsafe type casts and require static-analysis checks for type confusion.

References