CVE-2026-12295 is a sandbox escape vulnerability in the DOM Navigation component of Mozilla Firefox. It was reported by Yaqoub Aldurayhim and is classified as a high-impact security issue. The vulnerability allows an attacker to break out of the browser's sandbox environment, which is designed to isolate web content and limit the impact of exploits. This flaw affects Firefox versions prior to 152, Firefox ESR versions prior to 140.12, and Firefox ESR 115.37. Mozilla has addressed this vulnerability in Firefox 152 and the corresponding ESR releases. The vulnerability is part of a broader set of security fixes released in June 2026, which include multiple memory safety bugs, use-after-free issues, and other sandbox escapes. The CVSS v3.1 base score is 9.6, reflecting critical severity with network attack vector, low complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of CVE-2026-12295 allows an attacker to escape the browser's sandbox, potentially leading to arbitrary code execution with the privileges of the user running Firefox. This can compromise the confidentiality, integrity, and availability of the affected system. The vulnerability is critical, with a CVSS score of 9.6, indicating a severe risk to users running vulnerable versions of Firefox and Thunderbird prior to the fixed releases.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation requires applying the vendor's official updates. Patch status is confirmed by Mozilla advisories linked in the vendor advisory URLs. No additional mitigation steps are required beyond applying the official updates.