CVE-2026-12311: Firefox & Thunderbird Sandbox Escape Information Disclosure

Technical summary

This vulnerability combines information disclosure (CWE-200) with a sandbox escape condition (CWE-688) in Mozilla's process sandboxing implementation. The flaw allows an attacker to break out of or bypass the sandbox isolation layer, enabling read access to data that should remain confined. The CVSS v3.1 score of 4.7 reflects network-based attack feasibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and confidentiality impact limited to the user's context. The sandbox escape is context-dependent (Scope:Changed) but does not enable code execution or system modification on its own.

Business impact

For organizations deploying Firefox or Thunderbird in security-sensitive roles—such as handling classified communications, processing customer data, or isolating untrusted content—this vulnerability poses a confidentiality risk. An attacker could exfiltrate information that users believe is protected by the browser's sandboxing. The user-interaction requirement (UI:R) means targeted campaigns or social engineering are necessary, which narrows but does not eliminate risk for phishing-prone populations. Organizations relying on Firefox sandboxing as a compensating control for other security measures should prioritize remediation.

Affected systems

Firefox versions prior to 152, Firefox ESR versions prior to 140.12, Thunderbird versions prior to 152, and Thunderbird ESR versions prior to 140.12 are affected. Extended Support Release (ESR) users on older ESR branches should verify their specific version track. Organizations running Firefox in kiosk or unattended environments, or Thunderbird for organizational email, should inventory current deployments against these release thresholds.

Exploitability

This vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code is known at this time. However, the low attack complexity and network-based delivery mechanism mean exploitation is technically feasible once the attack method is fully understood. The requirement for user interaction (clicking a link, opening an attachment, or visiting a site) is a practical hurdle but not a strong barrier against determined threat actors targeting specific users or groups. The vulnerability likely attracts researcher interest given the high-profile nature of sandbox escapes.

Remediation

Update Firefox to version 152 or later, Firefox ESR to version 140.12 or later, Thunderbird to version 152 or later, and Thunderbird ESR to version 140.12 or later. ESR users should verify their branch (e.g., ESR 91, 102, 115) and apply the corresponding patch version. Automated update mechanisms are available; manual checks can be done via Help > About in Firefox or Thunderbird. Test patches in a non-production environment first if you manage corporate deployments.

Patch guidance

Mozilla's official Firefox and Thunderbird update channels will deliver patched versions automatically. For managed environments, verify patch deployment via version checks (Help > About Firefox or Thunderbird) or remote management tools. ESR deployments require special attention: confirm your ESR track and apply the correct 140.12+ version (or later ESR series if you have upgraded). Organizations running offline or airgapped instances should obtain patched binaries from Mozilla's official download pages and validate checksums before installation.

Detection guidance

Threat detection should focus on browser process activity and sandbox breakout indicators. Monitor for unusual inter-process communication or attempts to read files outside the expected sandbox boundary. Endpoint detection tools can flag process sandboxing bypasses via behavioral analysis. Network-level detection is limited but may catch malicious payloads if they're known. User awareness training emphasizing caution with unexpected links or email attachments reduces the user-interaction attack surface. Log browser version information during security assessments to identify unpatched instances.

Why prioritize this

Although CVSS 4.7 is medium severity, sandbox escapes warrant prioritized patching because they undermine a foundational security control that organizations rely on. The combination of information disclosure and sandbox bypass is more consequential than the numeric score suggests. The absence from the KEV catalog does not indicate low risk—it reflects current exploit status, not vulnerability severity. Organizations with sensitive data access through browsers, or where Firefox/Thunderbird is a primary security boundary, should treat this as elevated priority within the medium-risk category.

Risk score, explained

The CVSS v3.1 base score of 4.7 (Medium) reflects the following factors: network attack vector and low complexity favor attackers, but the requirement for user interaction and confidentiality-only impact (no integrity or availability) limit the score. The Scope:Changed vector means the vulnerability can affect resources beyond the vulnerable component (the sandbox itself), raising the score moderately. This scoring is appropriate for a sandbox escape that leaks information but does not enable arbitrary code execution or persistence. Organizations should apply their own risk multipliers based on Firefox/Thunderbird usage context and user population risk.

Frequently asked questions