CVE-2026-12323 is a spoofing vulnerability in the DOM: Core & HTML component of Mozilla Firefox. The flaw could allow an attacker to spoof content within the browser. This vulnerability was fixed in Firefox 152. The Mozilla advisory confirms the fix and lists this issue among many other security fixes in Firefox 152 and Thunderbird 152. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

The vulnerability allows spoofing in the DOM Core & HTML component, which could mislead users by presenting falsified content. The impact is limited to confidentiality with no integrity or significant availability impact. There are no known exploits in the wild. The medium severity rating reflects the potential for user deception but not direct code execution or privilege escalation.

Mozilla has released an official fix for this vulnerability in Firefox version 152. Users and administrators should update affected Firefox installations to version 152 or later to remediate this issue. No additional mitigation steps are indicated or required beyond applying the official update.