CVE-2026-12301 is a memory safety bug classified under CWE-119 that was present in Firefox versions before 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152 as part of a broader set of memory safety fixes. The bug could lead to memory corruption, which under certain conditions might allow arbitrary code execution. The CVSS v3.1 base score is 5.3 with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. Mozilla's official advisory (MFSA2026-57) confirms the fix and details that these memory safety bugs were identified and resolved through fuzzing and internal security efforts.

The vulnerability could allow an attacker to cause memory corruption remotely without requiring user interaction or privileges. While the impact is limited to confidentiality loss and does not affect integrity or availability, the memory corruption could potentially be leveraged for arbitrary code execution with sufficient effort. No known exploits in the wild have been reported. The vulnerability affects Firefox versions prior to 152.

An official fix is available in Mozilla Firefox version 152. Users and administrators should upgrade to Firefox 152 or later to remediate this vulnerability. Since this is a client-side application, updating the software is the primary mitigation. No additional vendor-recommended mitigations are specified. Patch status is confirmed by Mozilla's security advisory MFSA2026-57.