CVE-2026-12311

Analyzed Analyzed - Analysis Complete

Security Sandbox Escape in Firefox

Publication date: 2026-06-16

Last updated on: 2026-06-16

Assigner: Mozilla Corporation

Description

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-16

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-12311

EUVD

EUVD-2026-37102

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 152.0 (exc)
mozilla	firefox	From 140.0 (inc) to 140.12.0 (exc)
mozilla	thunderbird	to 152.0.0 (exc)
mozilla	thunderbird	From 140.0 (inc) to 140.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-688	The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Attack-Flow Graph

Compliance Impact

This vulnerability involves information disclosure and sandbox escape in the Security: Process Sandboxing component. Such vulnerabilities can potentially lead to unauthorized access to sensitive data.

Information disclosure vulnerabilities may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

However, specific impacts on compliance depend on the context of use, the data involved, and mitigation measures in place.

Executive Summary

This vulnerability involves information disclosure and sandbox escape within the Security: Process Sandboxing component of Mozilla Firefox. It allows an attacker to potentially bypass the sandbox restrictions designed to isolate processes, which could lead to unauthorized access to information or system resources.

Impact Analysis

The vulnerability can impact users by allowing attackers to escape the sandbox environment, potentially leading to unauthorized information disclosure or access to system resources that should be isolated. This could compromise the security and privacy of the affected system.

Mitigation Strategies

To mitigate this vulnerability, update Firefox to version 152 or later, or Firefox ESR to version 140.12 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-12311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70