CVE-2026-12294 is a sandbox escape vulnerability affecting the DOM: Workers component in Mozilla Firefox. The flaw allows an attacker to break out of the sandbox containment, which is designed to isolate potentially malicious code, thereby escalating privileges and compromising the security boundary. This vulnerability was addressed and fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird ESR 140.12. The vulnerability has a CVSS v3.1 base score of 9.6, reflecting critical severity with network attack vector and high impact on confidentiality, integrity, and availability. The vendor advisories confirm the fix and recommend updating to the patched versions.

Successful exploitation of this vulnerability can lead to sandbox escape, allowing attackers to execute arbitrary code with elevated privileges outside the restricted environment. This can result in full compromise of the affected Firefox or Thunderbird processes, potentially leading to data theft, system compromise, or further attacks. The CVSS score of 9.6 underscores the critical nature of this vulnerability with high impact on confidentiality, integrity, and availability.

A fix is available and has been officially released by Mozilla. Users and administrators should update affected products to Firefox 152, Firefox ESR 140.12, or Firefox ESR 115.37, as applicable. Similarly, Thunderbird users should update to version 152 or ESR 140.12. No additional mitigations are required beyond applying these official patches.