CVE-2026-12304 is a vulnerability in Mozilla Firefox's Networking: Cookies component that allows bypassing the same-origin policy. This security flaw could enable an attacker to access cookies from different origins, violating web security boundaries. Mozilla fixed this vulnerability in Firefox 152 and Firefox ESR 140.12. The vendor advisory classifies the impact as moderate and includes this fix among a large set of security patches released simultaneously. No exploitation in the wild has been reported, and the vulnerability was publicly disclosed on June 16, 2026.

The vulnerability enables a same-origin policy bypass in the cookies handling of Firefox, which could lead to unauthorized access to cookie data from other origins. This can compromise user privacy and security by exposing sensitive session or authentication cookies. The impact is considered moderate by Mozilla. There are no reports of active exploitation in the wild.

Mozilla has fixed this vulnerability in Firefox 152 and Firefox ESR 140.12. Users should update to these versions or later to remediate the issue. Since this is a client-side browser vulnerability, applying the official update is the primary and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated.