CVE-2026-12297: Sandbox escape due to incorrect boundary conditions in the Networking component

Synopsis

This is a sandbox escape vulnerability in the Networking component of Mozilla Firefox and Thunderbird. It is reachable over the network with no authentication required, but does require a victim to interact with attacker-controlled content; the CVSS scope change flag indicates a successful exploit breaks out of the browser or email client sandbox into the host environment. Successful exploitation gives an attacker full read, write, and denial-of-service capability over the affected system. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser or mail client over the network, for example by serving a malicious web page or HTML email from a remote host.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker only needs the victim to load attacker-controlled content.

• Victim interactionRequired

  The victim must take an action such as visiting a malicious URL or opening a crafted message, making social engineering a necessary part of exploitation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• Reads arbitrary files and sensitive data accessible to the browser or mail client process on the host, including session tokens, credentials stored on disk, and user documents.
• Writes or modifies files on the host filesystem outside the sandbox boundary, enabling persistent implants or tampering with application data.
• Crashes or denies service to the host-level process, not just the sandboxed tab or message context.
• Because the CVSS scope is Changed, impact extends beyond the sandboxed application to other processes and resources on the underlying host.