CVE-2026-12302 is a vulnerability in Mozilla Firefox's DOM security component that allows mitigation bypass. The flaw was addressed and fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. The vendor advisories confirm the fix availability and recommend updating to the fixed versions. No evidence of exploitation in the wild has been reported.

The vulnerability allows an attacker to bypass security mitigations in the DOM security component, potentially leading to unauthorized access to sensitive information or modification of data within the browser context. The impact is rated as medium severity with partial confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update affected Firefox and Firefox ESR installations to these versions or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisories.