This vulnerability involves a just-in-time (JIT) miscompilation issue within the DOM: Core & HTML component of Mozilla Firefox, identified as CVE-2026-12299. It affects versions prior to Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. The issue was reported by Hyeonjun Ahn and fixed in the stated versions. The CVSS v3.1 base score is 5.4, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact includes low confidentiality and integrity impacts, with no availability impact. Mozilla's official security advisories confirm the fix and provide references to the underlying bug (Bug 2043139).

The vulnerability could allow an attacker to cause incorrect JIT compilation in the DOM Core & HTML component, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates that exploitation requires user interaction but no privileges, and the attack can be performed remotely over the network. There are no reports of active exploitation in the wild. The impact is rated medium severity by Mozilla.

Mozilla has fixed this vulnerability in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Users and administrators should update to these versions or later to remediate the issue. Patch status is confirmed by the vendor advisories. No additional mitigation steps are indicated beyond applying the official updates.