CVE-2026-12297 is a sandbox escape vulnerability in Mozilla Firefox's Networking component due to incorrect boundary conditions. This vulnerability allows an attacker to escape the sandbox, potentially leading to arbitrary code execution or other high-impact consequences. It is part of a broader set of security fixes released in Firefox 152 and Firefox ESR 140.12 and 115.37, which address multiple high-impact memory safety bugs and sandbox escapes. The vulnerability is rated critical with a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Mozilla's official advisories confirm the fix in these versions. No evidence of exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, compromising the browser's security boundaries. This can lead to full compromise of the affected process, including arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability affects all Firefox versions prior to 152 and ESR versions prior to 140.12 and 115.37. No known exploits in the wild have been reported, but the high CVSS score reflects the critical nature of the flaw.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.