CVE-2026-12296 is a sandbox escape vulnerability affecting the Security: Process Sandboxing component in Mozilla Firefox and Thunderbird. The flaw allows an attacker to escape the sandbox protections, which are designed to isolate processes and limit the impact of exploits. This vulnerability was resolved in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The vulnerability has a CVSS v3.1 base score of 9.6, reflecting critical impact with high confidentiality, integrity, and availability consequences. The vendor advisories (MFSA 2026-57 and MFSA 2026-58) confirm the fix and provide detailed references to the underlying bugs. The advisories also list multiple other high-impact security fixes released simultaneously. No evidence of exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment, potentially gaining elevated privileges and executing arbitrary code outside the sandbox. This can lead to full system compromise, including unauthorized access to sensitive data, system integrity violations, and denial of service. The CVSS score of 9.6 indicates critical severity with network attack vector and no privileges required, making it a significant security risk if unpatched.

A fix is available and has been released by Mozilla in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Users and administrators should update to these versions or later to remediate this vulnerability. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Applying the official updates is the recommended mitigation.