CVE-2026-12302: Firefox and Thunderbird DOM Security Bypass

Technical summary

CVE-2026-12302 is a mitigation bypass in the Document Object Model (DOM) security component affecting Mozilla Firefox and Thunderbird. Classified as CWE-693 (Protection Mechanism Failure), this vulnerability allows an unauthenticated, network-accessible attacker to bypass DOM security controls with low attack complexity. The CVSS v3.1 score of 6.5 (MEDIUM) reflects the ability to achieve low-impact confidentiality and integrity violations without requiring privileges or user interaction, in an unchanged security scope.

Business impact

This vulnerability could enable attackers to bypass content security policies or other DOM-level protections within the browser environment. Potential impacts include unauthorized data exfiltration from browser sessions and manipulation of web content integrity. Organizations relying on Firefox or Thunderbird for secure browsing or email communications should prioritize patching to prevent potential data leakage and website spoofing attacks. The lack of availability impact limits business disruption, but the combination of confidentiality and integrity risks warrants timely remediation.

Affected systems

Mozilla Firefox (all versions prior to 152), Mozilla Firefox ESR (versions below 140.12 and 115.37), Mozilla Thunderbird (versions prior to 152), and Thunderbird ESR (versions below 140.12) are affected. Organizations using Extended Support Release versions should verify their specific ESR line, as Firefox ESR has two active branches requiring different patch versions.

Exploitability

Exploitation requires no authentication and no user interaction, with low attack complexity, making this vulnerability straightforward to weaponize over the network. However, the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited or no evidence of active exploitation in the wild at publication time. Nevertheless, the accessible attack vector and low complexity mean organizations should not assume time for leisurely patching.

Remediation

Update Firefox to version 152 or later, or patch Firefox ESR to version 140.12 (for the 140.x branch) or 115.37 (for the 115.x branch). Thunderbird users should update to version 152 or Thunderbird ESR 140.12. Organizations should verify the ESR branch currently deployed, as the maintenance timeline and patch versions differ between the 115.x and 140.x extended-support tracks.

Patch guidance

Mozilla releases browser updates automatically for most users; however, verify successful installation by checking Help > About Firefox (or Thunderbird > About Thunderbird) to confirm the running version matches or exceeds the patched release. For Thunderbird ESR 115.x users, ensure you are patching to 115.37 specifically, not 140.12, which is for the newer ESR branch. Enterprise environments managing browser deployments centrally should push updates through their standard deployment channels and verify rollout completion across the fleet.

Detection guidance

Monitor for any browser version reports in your environment indicating Firefox, Firefox ESR, Thunderbird, or Thunderbird ESR below the patched versions listed. Web application firewalls and endpoint detection systems may flag anomalous DOM manipulation attempts, though the nature of this bypass may make runtime detection difficult without specific instrumentation. Focus detection efforts on asset inventory and version enumeration until patches are deployed.

Why prioritize this

Although the CVSS score is MEDIUM and active exploitation is not confirmed, the combination of a network-accessible attack vector, zero user interaction requirement, and low complexity, paired with confidentiality and integrity impact, justifies treating this as a priority remediation. The simplicity of patching (automatic updates for most users) and the absence of a workaround mean this should be addressed within standard patch cycles, not deferred.

Risk score, explained

A CVSS v3.1 score of 6.5 reflects moderate risk. The score is driven by the network attack vector and low complexity, but tempered by the absence of authentication bypass, availability impact, or privilege escalation. The low confidentiality and integrity impact ratings, combined with unchanged security scope, keep the overall rating in the MEDIUM band. This is not a critical remote code execution or authentication failure, but it is a material security control bypass warranting attention.

Frequently asked questions