CVE-2026-12289 is a privilege escalation vulnerability in the Graphics: WebRender component of Firefox and Thunderbird products. It was fixed in Firefox 152, Firefox ESR 140.12, and Thunderbird 140.12 and 152. The vulnerability allows an attacker to escalate privileges, potentially compromising system security. The Mozilla advisories note that while exploitation via email in Thunderbird is mitigated by disabled scripting, the vulnerability remains a risk in browser or browser-like environments. This issue is part of a broader set of high-impact security fixes addressing memory safety bugs, sandbox escapes, and other vulnerabilities in these products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the affected application context, potentially leading to full compromise of the affected system or application. The impact is rated high due to the potential for privilege escalation and the critical nature of the Graphics: WebRender component. However, exploitation via email in Thunderbird is unlikely due to scripting restrictions. The vulnerability affects confidentiality, integrity, and availability.

This vulnerability has been fixed in Firefox 152, Firefox ESR 140.12, and Thunderbird 140.12 and 152. Users and administrators should apply these official updates to remediate the issue. No additional mitigation actions are required beyond applying the vendor-provided patches. There are no known exploits in the wild at this time.