CVE-2026-12315
Critical · 9.1CVSS
9.1
EPSS
0.3%
Published
Jun 16, 2026
CISA due date
—
The record
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | MozillaFirefox | 0 | 140.12.0-160000.1.1 |
| openSUSE:Leap 16.0 | MozillaThunderbird | 0 | 140.12.0-bp160.1.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 152.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.12.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 140.12.0-1.1 |
Related vulnerabilities
- CVE-2026-12324 Incorrect boundary conditions in the Graphics: CanvasWebGL component. Also affects MozillaFirefox
- CVE-2026-12325 Denial-of-service in the Graphics: ImageLib component. Also affects MozillaFirefox
- CVE-2026-12327 Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and… Also affects MozillaFirefox
- CVE-2026-12330 Incorrect boundary conditions in the Internationalization component. Also affects MozillaFirefox
- CVE-2026-12329 Memory safety bug fixed in Thunderbird ESR 140.12. Also affects MozillaFirefox
- CVE-2026-12328 Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR… Also affects MozillaFirefox
- CVE-2026-12314 Memory safety bug fixed in Thunderbird 152. Also affects MozillaFirefox
- CVE-2026-12311 Information disclosure, sandbox escape in the Security: Process Sandboxing component. Also affects MozillaFirefox