CVE-2026-12294: Sandbox escape in the DOM: Workers component

Synopsis

A sandbox escape vulnerability exists in the DOM Workers component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network without any authentication, but requires a user to interact with attacker-controlled content, such as visiting a malicious page or opening a crafted message. Successful exploitation gives an attacker full confidentiality, integrity, and availability impact across the browser or mail client process boundary, escaping the sandbox entirely. A patched-image rebuild at fix versions Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker can deliver a malicious payload by hosting it on a remote server reachable by the victim's browser or mail client.

• AuthenticationNot required

  No account or credential of any kind is needed before the attacker can attempt exploitation.

• Victim interactionRequired

  The victim must take an action, such as visiting an attacker-controlled web page or opening a crafted email message, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• A successful attacker escapes the browser or mail client sandbox and gains the ability to read any data accessible to the host process, including stored credentials, cookies, and local files.
• The attacker can write or modify data within the host process context, including persisting malicious content or altering application state.
• The attacker can crash or disrupt the affected Firefox or Thunderbird process, causing a denial of service for the end user.
• Because the scope token is Changed (S:C), impact extends beyond the sandboxed component itself, meaning the attacker can affect resources outside the original security boundary of the browser worker context.