CVE-2026-12307 is a memory safety bug in Mozilla Firefox reported by Atsushi Sada and fixed in Firefox 152 and Firefox ESR 140.12. It is part of a broader set of memory safety vulnerabilities fixed in these versions, some of which showed evidence of memory corruption that could lead to arbitrary code execution. The vulnerability was present in Firefox 151 and ESR 140.11 prior to the patch. Mozilla's official advisories MFSA2026-57 and MFSA2026-58 confirm the fix and provide detailed references to the underlying bugs. No CVSS score is provided, but the impact is assessed as moderate by Mozilla.

The vulnerability involves memory safety issues that could lead to memory corruption. With sufficient effort, these issues might have been exploited to run arbitrary code on affected systems. This poses a significant security risk including potential compromise of user systems running vulnerable Firefox versions.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side application vulnerability, patching the browser is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated.