CVE-2026-12315: Mitigation bypass in the DOM: Security component

Synopsis

A mitigation bypass in the DOM Security component of Mozilla Firefox and Thunderbird allows a remote attacker to reach the vulnerability over the network without any authentication or user interaction. The flaw stems from an incomplete security control in the browser's DOM layer, which an attacker can exploit to circumvent existing protections. Successful exploitation grants the attacker the ability to read sensitive data and modify content or state within the affected application. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected application over the network; no local or physical access is required.

• AuthenticationNot required

  No account or credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need the victim to click a link, open a file, or take any other action.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout are required.

Blast Radius

• A successful attacker reads sensitive data accessible to the browser or mail client, including stored session tokens, cookies, and rendered page content.
• A successful attacker modifies DOM state or content within the affected application, enabling content spoofing or tampering with data presented to the user.
• Containers or images bundling Firefox or Thunderbird expose any secrets or credentials those applications handle at runtime to exfiltration.
• Because scope is unchanged (S:U), impact is contained to the affected application process rather than the broader host, but that process may itself hold high-value data.