CVE-2026-12316: Mitigation bypass in the DOM: Security component

Synopsis

A mitigation bypass vulnerability exists in the DOM Security component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network with no authentication required and no user interaction needed, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker high-confidence read access to sensitive data and the ability to tamper with content or data in the affected context. A patched-image rebuild at version 152 is available on HarborGuard for environments running affected versions of Firefox or Thunderbird.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; no local access or physical proximity is required.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to attempt exploitation.

• Victim interactionNot required

  The exploit does not rely on a user clicking a link, opening a file, or taking any other action.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to align.

Blast Radius

• A successful attacker reads sensitive data accessible within the DOM Security context, such as session tokens, page content, or stored credentials exposed through the bypassed mitigation.
• A successful attacker modifies DOM content or data in ways the bypassed security controls were designed to prevent, enabling content injection or cross-origin data manipulation.
• Availability is not impacted by this vulnerability; the affected service continues running after exploitation.