VDB

CVE-2026-12295

CVE-2026-12295 PUBLISHED CVSS 9.6 CRITICAL

Sandbox escape in the DOM: Navigation component

Reported by mozilla · Published June 16, 2026

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
thunderbirderrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
firefox-esrChainguard140.12-r0
thunderbird-debuginfoerrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
firefoxerrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
firefox-debuginfoerrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
firefox-debugsourceerrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
thunderbird-debugsourceerrata.rockylinux.org140.12.0-1.el9, 140.12.0-1.el8, 140.12.0-1.el10
firefox-x11errata.rockylinux.org140.12.0-1.el9
firefoxAmazon Linux140.12.0-1.amzn2023.0.1
firefoxWolfi140.12-r0
thunderbirdAmazon Linux140.12.0-1.amzn2.0.1
firefoxChainguard140.12-r0

2 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

VendorProductVersions
MozillaFirefox115.37, 140.12, 152
MozillaThunderbird140.12, 152
Red HatRed Hat Enterprise Linux AppStream EUS (v. 10.0)
chainguardfirefox-esr0
Red HatRed Hat Enterprise Linux AppStream AUS (v.8.4)
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 100:140.12.0-1.el10_2
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:140.12.0-1.el9_4
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:140.12.0-1.el9_6
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:140.12.0-1.el8_6
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:140.12.0-1.el9_2
Red HatRed Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
Red HatRed Hat Enterprise Linux 100:140.12.0-1.el10_2
Red HatRed Hat Enterprise Linux AppStream (v. 10)
Red HatRed Hat Enterprise Linux 80:140.12.0-1.el8_10
Red HatRed Hat Enterprise Linux Server (v. 7 ELS)
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:140.12.0-1.el8_4
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 90:140.12.0-1.el9_8

…and 37 more

Timeline

  • Jun 16, 2026 CVE Published
  • Jun 17, 2026 EPSS Score (27 in total, the first dated here)
  • Jun 17, 2026 Coalition ESS Score
  • Jun 18, 2026 Security Advisory (26 in total, the first dated here)
  • Jun 22, 2026 Distribution Patch (30 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-12295
vulnetix vdb fixes CVE-2026-12295

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-12295/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 10 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›