CVE-2026-12295: Sandbox escape in the DOM: Navigation component

Synopsis

A sandbox escape vulnerability exists in the DOM Navigation component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network without any authentication, but requires the victim to interact with attacker-controlled content, as indicated by the CVSS vector (AV:N/PR:N/UI:R). Successful exploitation allows a remote attacker to break out of the browser sandbox and gain high-impact access to confidentiality, integrity, and availability of the underlying system. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network, for example by serving a malicious web page or email content to the victim.

• AuthenticationNot required

  No account or credentials are needed; the attacker requires no prior authentication to the affected application.

• Victim interactionRequired

  The victim must interact with attacker-controlled content, such as visiting a malicious URL or opening a crafted message, making social engineering a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• A successful attacker escapes the browser or mail-client sandbox entirely, gaining execution context outside its intended isolation boundary.
• High confidentiality impact means the attacker reads files, credentials, and other data accessible to the user running Firefox or Thunderbird on the host.
• High integrity impact means the attacker writes, modifies, or plants files and data on the host system under the victim user account.
• High availability impact means the attacker crashes or disrupts the affected application and potentially other processes accessible from the escaped sandbox context.