CVE-2026-12322 is a clickjacking vulnerability affecting the Widget: Gtk component in Mozilla Firefox. The vulnerability allows an attacker to potentially trick users into clicking on UI elements without their knowledge. This issue was resolved in Firefox 152. The Mozilla advisory confirms the fix and includes this vulnerability among multiple security fixes in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

The vulnerability could allow an attacker to perform clickjacking attacks, potentially leading to unintended user actions. The impact is limited to low confidentiality and availability impacts, with no integrity impact. There are no known exploits in the wild. The vulnerability affects Firefox versions prior to 152.

Mozilla has released an official fix for this vulnerability in Firefox 152. Users and administrators should update affected Firefox installations to version 152 or later to remediate this issue. No additional mitigation steps are required beyond applying the official update.