CVE-2026-12328: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Synopsis

Memory safety bugs, including evidence of memory corruption, affect Mozilla Firefox (all versions before 152 and ESR variants before 115.37 and 140.12) and Thunderbird (all versions before 152 and ESR 140.12). The vulnerability is reachable over the network without authentication or user interaction, though exploitation requires overcoming high attack complexity conditions. Successful exploitation enables an attacker to execute arbitrary code, read sensitive data, or tamper with application state. Patched-image rebuilds at versions 115.37, 140.12, and 152 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; there is no requirement for local access or physical proximity.

• AuthenticationNot required

  No credentials or session token are needed; an unauthenticated attacker can attempt exploitation directly.

• Victim interactionNot required

  The vulnerability does not require any action from a user or operator on the target system.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for race conditions, specific memory layout states, or other environmental factors that are not fully under their control.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Firefox or Thunderbird process, gaining the same OS-level permissions as the running application.
• Confidential data accessible to the browser or mail client, such as stored credentials, session cookies, and message content, can be read directly.
• The attacker can modify in-process data or persisted application state, including cached files and profile data.
• The affected process can be crashed or made unresponsive, disrupting access to the application for the duration of the attack.