CVE-2026-12311 is an information disclosure and sandbox escape vulnerability affecting the Security: Process Sandboxing component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to escape the sandbox environment, potentially exposing sensitive information. Mozilla fixed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The vulnerability has a CVSS 3.1 base score of 4.7 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. The vendor advisories (MFSA 2026-57 and MFSA 2026-58) provide detailed information and confirm the remediation status. No exploits in the wild are currently known.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox or Thunderbird, leading to information disclosure. The confidentiality impact is limited, with no integrity or availability impact reported. The vulnerability requires user interaction and can be exploited remotely over the network. No known active exploitation has been reported.

Official fixes are available and have been released by Mozilla. Users and administrators should update affected products to Firefox 152, Firefox ESR 140.12, Thunderbird 152, or Thunderbird 140.12 or later to remediate this vulnerability. Since this is not a cloud service, patching the client software is required. There is no indication from the vendor advisories that no action is required or that the issue is already mitigated without patching.