CVE-2026-12300: Firefox and Thunderbird Memory Safety Vulnerability (CVSS 5.3)

Technical summary

This is a memory safety bug (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) discovered and patched by Mozilla. The vulnerability permits information disclosure via a network vector with low attack complexity and no privilege requirements. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that an unauthenticated remote attacker can trigger the flaw to leak confidential information, though integrity and availability are not affected. The issue was remediated in Firefox version 152 and Thunderbird version 152 simultaneously.

Business impact

Organizations that rely on Firefox or Thunderbird for secure communications or data handling should treat this as a moderate-priority update. While the vulnerability does not enable system compromise, unauthorized access to sensitive communications or cached data is possible. For enterprises using Thunderbird as a managed email client, this poses a risk to email confidentiality. The lack of active exploitation in the wild (not on the KEV catalog) suggests this is a window for patching before widespread attack development.

Affected systems

The vulnerability affects Mozilla Firefox and Mozilla Thunderbird. All versions prior to 152 are vulnerable. This includes both consumer and enterprise deployments, particularly those running older release channels or extended support versions. Users on rapid release cycles (Firefox standard releases) or those on ESR (Extended Support Release) branches should verify their current version and patch status.

Exploitability

Exploitation is feasible for a sophisticated attacker, as no user interaction or special privileges are required—only network-level access to the application. However, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active, widespread exploitation or ransomware use. This represents a valuable patching window before threat actors develop working exploits.

Remediation

Update Firefox to version 152 or later, and Thunderbird to version 152 or later. Both updates are available through the respective application update mechanisms. Users should enable automatic updates if not already configured. For organizations with managed deployments, ESR (Extended Support Release) users should verify they have access to version 152 ESR and schedule rollout accordingly.

Patch guidance

1. Check your current Firefox or Thunderbird version (Help > About Firefox or Help > About Thunderbird). 2. If running a version earlier than 152, initiate an update immediately through the in-app update mechanism or download the latest version from mozilla.org. 3. For enterprise environments, test Firefox 152 and Thunderbird 152 in a non-production environment to confirm compatibility with corporate add-ons and configurations before broad deployment. 4. Monitor for any ESR-specific patches if your organization is locked to Extended Support Release versions.

Detection guidance

Monitor endpoint logs for Firefox and Thunderbird process behavior indicative of memory exploitation attempts, such as unexpected crashes or unusual memory access patterns. Network-level detection should focus on identifying suspicious network connections initiated by these applications to untrusted or anomalous destinations. Endpoint Detection and Response (EDR) tools should flag abnormal file access or data exfiltration from browser caches and email client storage directories. Vulnerability scanners should confirm patch installation across managed systems.

Why prioritize this

This Medium-severity vulnerability merits prompt patching because it enables data confidentiality breaches without requiring user interaction or privilege escalation. The network-based attack vector and lack of complexity make it accessible to determined adversaries. While currently unexploited in the wild, the simplicity of the attack path and the high value of stealing cached credentials or email content from these ubiquitous applications makes it a reasonable target for future exploit development. Prioritize systems handling sensitive communications or authentication tokens.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects a balance between moderate impact and relatively low barriers to exploitation. The network attack vector, low complexity, and absence of privilege or interaction requirements elevate concern, but the impact is limited to confidentiality; integrity and availability remain intact. Organizations should not dismiss this as low-priority—the information disclosure risk is real and affects all users, though the severity does not warrant emergency patching protocols.

Frequently asked questions