CVE-2026-12304 is a vulnerability in Mozilla Firefox and Thunderbird's Networking: Cookies component that allows bypassing the same-origin policy. This security flaw could enable an attacker to access or manipulate cookies across origins, violating web security boundaries. The vulnerability was addressed and fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. Mozilla's official advisories (MFSA 2026-57 and MFSA 2026-58) confirm the fix and provide references to the underlying bug reports.

Successful exploitation of this vulnerability could allow an attacker to bypass the same-origin policy, potentially leading to unauthorized access to sensitive cookie data and compromising user privacy and security. The CVSS score of 9.1 reflects a critical impact on confidentiality and integrity without requiring privileges or user interaction. There are no known exploits in the wild at the time of publication.

This vulnerability has been fixed in Mozilla Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Users and administrators should update affected products to these versions or later to remediate the issue. Mozilla manages the patching process for these products and has published official advisories detailing the fixes. Patch status is confirmed by the vendor advisories. No additional mitigations beyond applying the official updates are indicated.