CVE-2026-12326: Memory safety bugs fixed in Firefox 152 and Thunderbird 152

Synopsis

Memory safety bugs, including evidence of memory corruption, affect Mozilla Firefox and Thunderbird versions prior to 152. The vulnerability is reachable over the network with no authentication or user interaction required, meaning any page or content served to the browser can trigger the flaws. Successful exploitation enables an attacker to read data, modify data, or crash the affected application, and with sufficient effort may allow arbitrary code execution. A patched-image rebuild at version 152 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected application over the network, for example by serving malicious content to a browser or mail client exposed to internet or internal network traffic.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is reachable by any unauthenticated party who can deliver content to the affected application.

• Victim interactionNot required

  No user action beyond normal application use is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and imposes no special preconditions; no race conditions or specific memory layout requirements are noted in the CVSS scoring.

Blast Radius

• An attacker can read data accessible to the Firefox or Thunderbird process, including in-memory session tokens, cached credentials, and rendered page content.
• An attacker can modify data within the process, potentially altering rendered content or in-memory application state.
• The affected application process can be crashed, causing a denial of service for the end user.
• With sufficient exploitation effort against the memory corruption primitives, an attacker may execute arbitrary code under the permissions of the browser or mail client process.