CVE-2026-12299: Firefox & Thunderbird JIT Miscompilation Data Leakage Vulnerability

Technical summary

CVE-2026-12299 is a JIT miscompilation vulnerability affecting the DOM: Core & HTML component in Mozilla's rendering engine. The flaw resides in the just-in-time compiler's optimization and code generation logic, which fails to correctly handle certain DOM-related operations. This results in memory safety issues (CWE-733: Race Condition in accessing data, CWE-843: Access of Resource Using Incompatible Type) that permit limited information disclosure and content modification. The vulnerability manifests when the JIT compiler generates machine code that incorrectly manages memory access patterns, allowing an attacker-controlled webpage to read adjacent memory or modify DOM state in unintended ways. Exploitation requires the user to load a malicious page in the affected browser; no additional privileges, network sniffing, or local file access is needed.

Business impact

This vulnerability poses a moderate risk to organizations where employees browse untrusted or compromised websites. The primary business concern is data leakage—confidential information rendered in the browser (form data, session tokens, visible page content) could be extracted by a malicious site. Secondary impact includes defacement or manipulation of page behavior, which could damage user trust or enable social engineering attacks if an attacker modifies visual elements. Organizations relying on Firefox or Thunderbird for secure communications should prioritize patching to prevent potential credential or message content exposure. The requirement for user interaction limits the scope of automated attack scenarios but does not eliminate risk in environments where users access diverse web content.

Affected systems

Mozilla Firefox prior to version 152, Firefox ESR versions before 140.12 and before 115.37, Mozilla Thunderbird prior to version 152, and Thunderbird version 140.x before 140.12 are vulnerable. Organizations running older Firefox ESR releases (the extended support channel used in many enterprises) must apply ESR-specific patches. Thunderbird users, particularly those using it as their primary email client, are similarly affected. Systems where Firefox or Thunderbird are automatically updated may already be protected; manual verification is recommended for environments with managed or frozen update policies.

Exploitability

This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of active exploitation in the wild as of the last update. However, the low attack complexity (AC:L) and network accessibility (AV:N) combined with only requiring user interaction (UI:R) make this a practical target for watering-hole attacks or phishing campaigns that direct users to malicious pages. The barrier to exploitation is moderate—an attacker must craft a webpage or compromise an existing one—but the ability to exfiltrate browser-visible data with no special privileges makes it attractive. Given the age of modern browser exploits, this issue should not be considered a low-priority matter despite the CVSS 5.4 score.

Remediation

Update Firefox to version 152 or later, Thunderbird to version 152 or later, Firefox ESR to version 140.12 or later (or 115.37 if running the older ESR track), and Thunderbird ESR to version 140.12 or later. Verify against the official Mozilla security advisories for your specific release branch. Most users will receive automatic updates; administrators of managed deployments should deploy patches through their update management systems. Until patches are applied, minimize exposure by restricting user browsing to trusted domains and educating users to avoid clicking links from untrusted sources.

Patch guidance

Mozilla has released fixes in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Organizations on Firefox ESR should determine which track they support (the 140.x or 115.x series) and apply the corresponding patch. Verify your current version by opening the application menu → Help → About [Firefox/Thunderbird]; the version number is displayed prominently. Enterprise deployments using Mozilla's update server or managed distribution should configure automatic patching immediately. For air-gapped environments, download the offline installer from Mozilla's official download pages and deploy through your configuration management tools. Test patches in a non-production environment first, particularly if you have custom extensions or plugins, to confirm compatibility.

Detection guidance

Directly detecting exploitation of JIT miscompilation is challenging without advanced runtime monitoring. Network-level detection is unlikely to yield reliable signals. Organizations should focus on: (1) Verify installed Firefox and Thunderbird versions using endpoint management tools or scripts; flag systems running versions older than 152 (or the applicable ESR versions) for immediate patching. (2) Monitor application crash logs or browser console errors that might indicate memory corruption; however, JIT bugs often fail silently. (3) Use telemetry data from endpoint detection and response (EDR) solutions to identify unusual memory access patterns or suspicious DOM manipulation, though these signals are not specific to this CVE. (4) Implement web filtering to block known malicious domains; this is a preventive control rather than a post-exploitation detection mechanism. Log patch deployment success to confirm systems have been updated.

Why prioritize this

Although rated CVSS 5.4 (Medium), this vulnerability warrants prompt attention due to its network-accessible attack surface, low complexity, and practical risk of data exfiltration. The absence from the KEV catalog suggests it is not yet actively exploited, making this a window of opportunity to patch before adversaries weaponize it. Users who frequently visit diverse websites or check email in the browser face higher risk. Enterprises with strict update policies should prioritize this over lower-CVSS vulnerabilities affecting less-exposed services. The fix is stable and well-tested across Firefox's user base; deployment risk is low.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a Medium severity. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N indicates: network-accessible attack surface (AV:N), low complexity exploitation (AC:L), no privilege requirement (PR:N), user interaction needed (UI:R), single security domain (S:U), low confidentiality impact (C:L), low integrity impact (I:L), and no availability impact (A:N). The score appropriately penalizes the vulnerability for requiring user interaction and limiting scope to confidentiality and integrity, but does not discount the ease of triggering it. In practice, organizations should consider raising their internal risk rating if browsing untrusted content is common or if users handle sensitive data in-browser.

Frequently asked questions