CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component

Synopsis

A sandbox escape vulnerability exists in the Security: Process Sandboxing component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network, requires no authentication, but does require a user to interact with malicious content (for example, visiting a crafted page or opening a crafted message). Successful exploitation lets an attacker break out of the browser or email client sandbox and gain full read, write, and availability impact on the host, including reading files and credentials, modifying data, and crashing processes. A patched-image rebuild at Firefox 152 and Firefox ESR 140.12 (and the equivalent Thunderbird versions) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the target's browser or email client via a network-delivered payload such as a malicious website or email.

• AuthenticationNot required

  No account or credentials are needed; the attacker can target any user without prior access to the system.

• Victim interactionRequired

  The attacker must socially engineer the victim into triggering the exploit, for example by convincing them to visit a crafted web page or open a crafted email message.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout assumptions, or other environmental factors to succeed.

Blast Radius

• Reads arbitrary files and sensitive data accessible to the sandboxed process, including stored credentials and session tokens.
• Modifies files and data on the host that the escaped process can reach, enabling persistent changes outside the sandbox boundary.
• Crashes or disrupts the affected Firefox or Thunderbird process and any dependent services, causing denial of service.
• Scope is marked Changed (S:C), meaning impact extends beyond the sandboxed component itself to the underlying host or other processes sharing the system.