CVE-2026-12291: Firefox & Thunderbird HTTP Use-After-Free RCE (CVSS 8.8)

Technical summary

This use-after-free (CWE-416) vulnerability exists in the HTTP networking stack of Mozilla applications. The flaw allows an attacker to dereference memory that has already been deallocated, potentially leading to arbitrary code execution. The vulnerability is also associated with CWE-825 (Expired Pointer Dereference), indicating that the freed memory reference persists and can be exploited under attacker-controlled conditions. The attack vector is network-based with low complexity; the user must interact with a malicious resource (link, embedded content, or email attachment that opens in the browser/email client).

Business impact

Compromise of Firefox or Thunderbird on an endpoint can lead to complete system takeover. An attacker exploiting this flaw gains the same privileges as the user running the browser or email client. For enterprise environments, this creates a direct path to lateral movement, credential theft, malware deployment, and data exfiltration. Thunderbird users risk exposure of cached email credentials and stored messages. The requirement for user interaction means the attack vector is social engineering—phishing emails, malicious advertisements, or compromised websites—making widespread exploitation feasible across diverse user populations.

Affected systems

Firefox versions prior to 152 are vulnerable. Firefox ESR users must update to version 140.12 or 115.37 depending on their release branch. Thunderbird versions prior to 152 are affected, with ESR users requiring update to version 140.12. Any organization deploying Firefox as a standard browser or Thunderbird as an email client is in scope.

Exploitability

The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation has been reported as of the knowledge cutoff. However, the low attack complexity, network accessibility, and the presence of a user-interaction requirement (which is routine for web browsing and email) make this vulnerability attractive for targeted campaigns. The high CVSS score (8.8) reflects the severity: authentication is not required, the attack complexity is minimal, and the impact spans confidentiality, integrity, and availability.

Remediation

Update immediately to the patched versions: Firefox 152 or later, Firefox ESR 140.12 (or 115.37 for the extended-support branch), Thunderbird 152 or later, or Thunderbird ESR 140.12. Mozilla released fixes across all affected branches to address the use-after-free condition. Organizations should prioritize deployment of these patches, particularly for users handling sensitive data or those at elevated risk of social engineering.

Patch guidance

Deploy Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, or Thunderbird ESR 140.12 through your organization's software update mechanism. Most modern deployments will auto-update; verify that automatic updates are enabled and functioning. For managed environments, push updates via MDM/EPM solutions or group policy. Test patches in a non-production environment first to confirm compatibility with any browser extensions, plugins, or email integrations. After deployment, verify rollout coverage across all managed endpoints.

Detection guidance

Monitor for successful exploitation by tracking process execution originating from browser or Thunderbird processes (suspicious child processes, command shells, or downloads). Network detection is difficult post-exploitation; focus instead on behavioral indicators such as unexpected outbound connections from Firefox or Thunderbird, or unusual memory corruption errors in application logs. Ensure EDR (endpoint detection and response) solutions are configured to alert on suspicious process spawning from these applications. Before patching is complete, educate users on phishing indicators and encourage reporting of suspicious emails or links.

Why prioritize this

This vulnerability should be prioritized as HIGH due to the combination of high CVSS score (8.8), broad attack surface (any web browsing or email activity), and severe impact (arbitrary code execution with user privileges). The lack of KEV designation does not reduce priority—it reflects that public exploitation has not yet been formally documented, not that the vulnerability is low-risk. The use-after-free nature and network attack vector make this suitable for both opportunistic and targeted exploitation.

Risk score, explained

CVSS 8.8 (HIGH) reflects a network-accessible attack requiring minimal complexity and user interaction, with impacts spanning confidentiality, integrity, and availability. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the threat is broadly exploitable in real-world conditions. The vulnerability affects core networking functionality, not a niche feature, making large user bases potential targets.

Frequently asked questions