CVE-2026-12302 is a mitigation bypass vulnerability located in the DOM security component of Mozilla Firefox. It was reported by the security researcher lebr0nli and assigned moderate impact by Mozilla. The vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37 as part of a security update addressing multiple vulnerabilities. The vendor advisories indicate that this issue is one among several memory safety, sandbox escape, and mitigation bypass bugs resolved in these releases. No CVSS score is provided, but the vendor rates the impact as moderate. There are no known exploits in the wild for this vulnerability.

The vulnerability allows bypassing security mitigations in the DOM security component, which could potentially weaken the browser's security defenses. However, the impact is rated moderate by Mozilla, indicating that while it poses a security risk, it is not considered critical or high severity. There are no reports of active exploitation in the wild. The fix eliminates the vulnerability in the specified Firefox versions.

A fix for CVE-2026-12302 is available and has been incorporated into Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. Users and administrators should update affected Firefox installations to these versions or later to remediate this vulnerability. Since this is a client software vulnerability, patching is the primary and recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated.