CVE-2026-12299

Modified Modified - Updated After Analysis

JIT Miscompilation in Firefox DOM Core

Publication date: 2026-06-16

Last updated on: 2026-06-30

Assigner: Mozilla Corporation

Description

JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-16

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-12299

EUVD

EUVD-2026-37090

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 152.0 (exc)
mozilla	firefox	to 115.37.0 (exc)
mozilla	firefox	From 140.0 (inc) to 140.12.0 (exc)
mozilla	thunderbird	to 152.0.0 (exc)
mozilla	thunderbird	From 140.0 (inc) to 140.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-733	The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a JIT (Just-In-Time) miscompilation issue in the DOM: Core & HTML component of Mozilla Firefox. It means that the JIT compiler, which is responsible for optimizing code execution, incorrectly compiles certain code related to the Document Object Model (DOM) and HTML processing.

The issue was addressed and fixed in Firefox versions 152, Firefox ESR 140.12, and Firefox ESR 115.37.

Mitigation Strategies

To mitigate this vulnerability, update Firefox to version 152 or later, or update Firefox ESR to version 140.12 or later, or ESR 115.37 or later.

Impact Analysis

This vulnerability involves a JIT miscompilation in the DOM: Core & HTML component of Mozilla Firefox. Such a flaw could potentially lead to incorrect execution of code within the browser, which might cause unexpected behavior, crashes, or security issues when rendering web content.

It was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, so using these or later versions mitigates the risk.

Hi! I’m here to help you understand CVE-2026-12299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70