CVE-2026-12289 is a privilege escalation vulnerability in the Graphics: WebRender component of Mozilla Firefox. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. It is classified as high severity with a CVSS 3.1 base score of 8.8, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability allows an attacker to escalate privileges potentially compromising the affected system. Mozilla's official security advisories (MFSA 2026-57 and MFSA 2026-58) confirm the fix and provide detailed references to the underlying bugs. The affected versions are all Firefox versions before 152, Firefox ESR before 140.12, and Firefox ESR before 115.37. No known exploits in the wild have been reported at the time of publication.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox process, potentially leading to arbitrary code execution or further compromise of the user's environment. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. Given the high CVSS score and the nature of the bug in the graphics rendering component, exploitation could be leveraged in targeted attacks or combined with other vulnerabilities for broader impact.

Mozilla has released official patches fixing this vulnerability in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. There is no indication from the vendor advisories that additional mitigations or workarounds are required beyond applying the official updates.