Memory safety vulnerability in Mozilla Firefox/Firefox ESR/Thunderbird

Successful exploitation could cause memory corruption, application instability or crash, and potentially arbitrary code execution. Broader Mozilla and downstream advisories also note that the most severe issues in the affected release set may enable impacts such as privilege escalation, sandbox escape, same-origin policy bypass, information disclosure, spoofing, or denial of service; however, the supplied content does not attribute all of those impacts specifically to CVE-2026-12290. The most directly supported impact for this CVE is memory corruption with possible arbitrary code execution.

No CVE-specific workaround is provided in the supplied advisories. Recommended mitigation is prompt patching. Until updates are fully deployed, reduce exposure by enforcing least privilege, avoiding administrative execution contexts, enabling exploit-protection controls, restricting access to untrusted web content and attachments, and using host-based detection/prevention and application control where feasible.

Upgrade affected products to fixed versions: Firefox 152 or later, Firefox ESR 140.12 or later, Firefox ESR 115.37 or later, Thunderbird 152 or later, and Thunderbird ESR 140.12 or later. Debian users should apply the firefox-esr update to version 140.12.0esr-1~deb13u1 for the stable distribution as referenced in the supplied advisory.