CVE-2026-12310: Firefox and Thunderbird Memory Safety Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-12310 is a memory safety bug affecting Mozilla's browser and mail client families. The vulnerability maps to multiple memory corruption weaknesses (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125: Out-of-bounds Read; CWE-416: Use After Free; CWE-787: Out-of-bounds Write), indicating the underlying flaw may involve buffer overflows or use-after-free conditions in the browser's rendering or scripting engine. The CVSS 3.1 score of 7.5 reflects a high-severity network-based attack vector with low complexity, no privilege requirement, and no user interaction needed—though the impact is confidentiality loss only, with no integrity or availability concerns noted. The network-reachable attack surface and the absence of authentication barriers make this a meaningful risk for any system running vulnerable versions.

Business impact

Organizations relying on Firefox or Thunderbird for email, web browsing, or embedded browser functionality face a data exposure risk. Attackers can extract sensitive information—such as cached credentials, browsing history, or email metadata—from memory without triggering warnings or requiring social engineering. For enterprises using Thunderbird as a corporate email client or Firefox in managed environments, this vulnerability could lead to lateral movement or credential compromise if an attacker can direct users to a malicious web page or intercept network traffic. The lack of integrity impact means data modification is not a direct concern, but confidentiality breaches can still cascade into broader security incidents.

Affected systems

Vulnerable versions include Firefox releases prior to 152, Firefox ESR versions before 140.12, Thunderbird before 152, and Thunderbird ESR before 140.12. Any endpoint, server, or embedded system running these unpatched versions is at risk. This includes Windows, macOS, and Linux installations. ESR (Extended Support Release) users on older release cycles are particularly affected if they have not updated to the patched ESR versions.

Exploitability

The vulnerability is exploitable with no authentication, no user interaction required beyond visiting a malicious webpage or opening a crafted email link, and low attack complexity. An attacker can trigger the memory read condition remotely over the network. However, the attack requires knowledge of the exact memory layout or valid pointers within the browser process—techniques such as information disclosure chaining or heap spraying may be necessary for reliable exploitation. The absence of KEV (Known Exploited Vulnerability) listing suggests active exploitation has not yet been documented by CISA, though the low barrier to weaponization means this status could change.

Remediation

Immediately update to Firefox 152 or later, Firefox ESR 140.12 or later, Thunderbird 152 or later, or Thunderbird ESR 140.12 or later, depending on which product and release channel your organization uses. Users on extended support releases should verify they are targeting the correct ESR patch version. Automated patch management and phased rollout testing are recommended before enterprise-wide deployment to prevent workflow disruption.

Patch guidance

Mozilla has released patches across all affected product lines and branches. Verify your current Firefox or Thunderbird version (Help > About in Firefox; Help > About Thunderbird in Thunderbird) and compare against the fixed versions listed. Organizations should enable automatic updates or use centralized patch management to deploy fixes. For ESR environments, confirm the ESR version number matches the patch threshold (140.12 or higher). Test patches in a non-production environment first, particularly if integrations or add-ons are in use, to rule out compatibility regressions.

Detection guidance

Monitor for crashes or anomalous memory access patterns in browser or email client logs if forensic investigation is needed. At the network level, look for unusual outbound connections from browser processes following the delivery of web content, which could indicate data exfiltration. Endpoint detection and response (EDR) tools should flag heap spray or memory manipulation attempts if the browser process exhibits suspicious behavior. Log version information from installed Firefox and Thunderbird instances; any version below the patch thresholds indicates exposure. Browser extension activity should be reviewed, as malicious add-ons could be leveraged to trigger or exploit the memory flaw.

Why prioritize this

This vulnerability scores a CVSS 7.5 (HIGH) due to its network attack vector, lack of complexity, and confidentiality impact. The absence of user interaction or authentication requirements and the widespread deployment of Firefox and Thunderbird across enterprises and consumer devices make it a priority target. Although not yet in the KEV catalog, the low barrier to exploitation means it warrants urgent patching. Organizations should treat this as a critical update for any security-sensitive deployment.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 7.5. The network attack vector (AV:N) and low attack complexity (AC:L) reflect ease of exploitation. No privilege requirement (PR:N) and no user interaction (UI:N) eliminate common mitigating factors. Confidentiality impact is high (C:H), meaning an attacker can read sensitive data; integrity and availability are not impacted (I:N, A:N). The score does not reach CRITICAL (8.0+) because the attack does not compromise system integrity or availability, only confidentiality.

Frequently asked questions