CVE-2026-12326 covers multiple memory safety vulnerabilities in Firefox 151 and Thunderbird 151, including use-after-free, sandbox escapes, and boundary condition errors in components such as WebRender, Networking, Web Audio, and process sandboxing. These bugs showed evidence of memory corruption and could potentially be exploited to execute arbitrary code. Mozilla fixed these issues in Firefox 152 and Thunderbird 152. The vendor advisories (MFSA2026-57 and MFSA2026-60) detail numerous related CVEs with high to moderate impact, all resolved in the stated fixed versions. Exploitation risk in Thunderbird is reduced due to disabled scripting in email reading contexts, but browser contexts remain vulnerable if unpatched.

The vulnerabilities allow for potential arbitrary code execution due to memory corruption bugs, posing a high impact on confidentiality, integrity, and availability of affected systems. Some bugs enable sandbox escapes and privilege escalation, increasing the severity of the threat. While Thunderbird's email reading context reduces exploitation risk, browser or browser-like contexts remain exposed if unpatched.

Mozilla has released official fixes for these vulnerabilities in Firefox 152 and Thunderbird 152. Users and administrators should update to these versions or later to remediate the issues. Since these are memory safety bugs fixed by official patches, applying the updates fully mitigates the threat. No additional vendor-recommended mitigations are necessary beyond updating.