CVE-2026-12301: Firefox & Thunderbird Memory Safety Vulnerability

Technical summary

CVE-2026-12301 is a memory safety bug classified under CWE-119 (Buffer Overflow and Related Errors) affecting the Firefox and Thunderbird browsers. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, no authentication required, and limited impact to confidentiality without integrity or availability compromise. Mozilla released fixes in Firefox 152 and Thunderbird 152 on or around June 16, 2026.

Business impact

Organizations deploying Firefox or Thunderbird in production environments—including as email clients or web browsers for employees—face a limited but real risk of data exposure. Since exploitation does not require user interaction and the attack vector is network-based, users browsing untrusted content or opening emails could inadvertently leak sensitive information. For enterprises managing large desktop populations, this creates a patch management obligation and potential compliance considerations, though the medium severity and lack of active exploitation in the wild reduce immediate operational urgency.

Affected systems

Mozilla Firefox and Mozilla Thunderbird prior to version 152 are affected. Both applications receive fixes in the same version bump, simplifying patch coordination. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation at publication time. Desktop and potentially mobile deployments of both products are in scope.

Exploitability

The vulnerability is network-accessible and requires no authentication, user interaction, or special privileges. Attack complexity is low, suggesting a straightforward exploitation path. However, the lack of KEV designation and the specificity of the memory safety bug suggest this is not a trivial 'one-click' attack; exploitation likely requires crafted network input or malicious web content. The confidentiality-only impact (no code execution or denial of service) limits the appeal for mass exploitation campaigns, though targeted data exfiltration remains possible.

Remediation

End users and organizations should upgrade Firefox and Thunderbird to version 152 or later. The fix addresses the underlying memory safety defect; no workarounds are documented. For enterprise deployments, this update should be prioritized within normal patch cycles, grouped with any concurrent security updates to reduce deployment overhead.

Patch guidance

Mozilla has released Firefox 152 and Thunderbird 152 containing the fix. Verify availability of these versions through the official Mozilla download pages (mozilla.org/firefox and mozilla.org/thunderbird). For organizations using enterprise deployment tools, configure automated updates or deploy the patched versions through your software distribution mechanism. Test in a limited environment if your change control process requires it, though this is a straightforward security update with no known compatibility issues. Desktop and portable versions should both be updated.

Detection guidance

Verify the installed versions of Firefox and Thunderbird across your environment using endpoint management tools (SCCM, Jamf, etc.) or local system audits. Flag any instances below version 152. Web proxies or email gateway logs may reveal attempted exploitation patterns (malformed network requests to Firefox or Thunderbird processes), but direct detection of the vulnerability's exploitation in the wild is unlikely given the lack of public exploit code and KEV status. Monitor Mozilla security advisories for any new information.

Why prioritize this

This update merits standard-priority handling in most environments. The medium CVSS score, lack of user interaction requirement, and network vector justify near-term patching, but the absence of KEV designation, confidentiality-only impact, and low attack complexity (indicating limited real-world exploitation) mean this is not a critical emergency. Organizations should bundle this with regular patch cycles and complete deployment within 30–60 days. Environments handling highly sensitive data or with adversaries capable of sophisticated memory exploitation should prioritize slightly higher.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects a balance of concerning and limiting factors. Network accessibility and no authentication requirement elevate risk; however, confidentiality-only impact without code execution or availability compromise, combined with the low likelihood of active exploitation (no KEV listing), prevents a higher rating. The flaw requires specific memory manipulation, not generic network access, so practical attack difficulty moderates the score.

Frequently asked questions