CVEFinder.io

CVE-2026-12290

⚠️ high
🔍 Scan for this CVE
Summary

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVSS Score
8.1
High
EPSS Score
0.4
Exploit Probability
Published Date
2026-06-16
First Seen: 2026-06-17
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 77.3% of all 338,292 vulnerabilities in our database.

#76,799
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 17, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
jayjayjazz
SSVC data provided by CISA
Last Modified 2026-07-15
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE IDs (Weakness Types)
CWE-119 CWE-823

📦 Affected Products 5

Vendor Product Status Affected Versions
mozilla firefox Affected
< 115.37.0
mozilla firefox Affected
> 140.0 < 140.12.0
mozilla firefox Affected
< 152.0.0
mozilla thunderbird Affected
> 140.0 < 140.12.0
mozilla thunderbird Affected
< 152.0.0

🔗 References 30

https://bugzilla.mozilla.org/show_bug.cgi?id=2024852
Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:27717
https://access.redhat.com/errata/RHSA-2026:27733
https://access.redhat.com/errata/RHSA-2026:27734
https://access.redhat.com/errata/RHSA-2026:29940
https://access.redhat.com/errata/RHSA-2026:30846
https://access.redhat.com/errata/RHSA-2026:33445
https://access.redhat.com/errata/RHSA-2026:36100
https://access.redhat.com/errata/RHSA-2026:36101
https://access.redhat.com/errata/RHSA-2026:36102
https://access.redhat.com/errata/RHSA-2026:36103
https://access.redhat.com/errata/RHSA-2026:37210
https://access.redhat.com/errata/RHSA-2026:37391
https://access.redhat.com/errata/RHSA-2026:38506
https://access.redhat.com/errata/RHSA-2026:38750
https://access.redhat.com/errata/RHSA-2026:38751
https://access.redhat.com/errata/RHSA-2026:38753
https://access.redhat.com/errata/RHSA-2026:39011
https://access.redhat.com/errata/RHSA-2026:39141
https://access.redhat.com/errata/RHSA-2026:39142
https://access.redhat.com/errata/RHSA-2026:39428
https://access.redhat.com/errata/RHSA-2026:39706
https://access.redhat.com/security/cve/CVE-2026-12290
https://bugzilla.redhat.com/show_bug.cgi?id=2489210
https://security.access.redhat.com/data/csaf/v2/vex/...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-16349 ⛔ critical 9.8 0.2 Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115... 2026-07-21
CVE-2026-16350 ⛔ critical 9.8 0.4 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ... 2026-07-21
CVE-2026-16351 ⛔ critical 9.8 0.4 Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Fire... 2026-07-21
CVE-2026-16352 ⛔ critical 9.8 0.4 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 15... 2026-07-21
CVE-2026-16353 ⛔ critical 9.8 0.4 Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38... 2026-07-21
CVE-2026-16354 ⚠️ high 7.5 0.3 Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115... 2026-07-21
These CVEs affect the same products