CVE-2026-12290 is a memory safety bug in Mozilla Firefox and Firefox ESR that was addressed in Firefox 152 and Firefox ESR 140.12. The vulnerability relates to memory corruption issues that could be exploited to execute arbitrary code. The Mozilla advisories (MFSA 2026-57 and MFSA 2026-58) confirm the fix and classify the impact as high. The vulnerability is part of a broader set of memory safety bugs fixed in these releases. Affected versions include all Firefox versions before 152 and Firefox ESR versions before 140.12. No public exploits have been observed. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

This vulnerability can lead to memory corruption in affected Firefox versions, which may allow an attacker to execute arbitrary code with the privileges of the user running the browser. The CVSS score of 8.1 reflects a high impact on confidentiality and integrity, with no impact on availability. Exploitation requires user interaction but no privileges or complex attack conditions. No known exploits in the wild have been reported, but the potential for arbitrary code execution represents a significant risk.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by Mozilla advisories linked in the input data.