This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Mozilla fixes over 40 vulnerabilities

Mozilla fixes over 40 vulnerabilities in various products. Selected vulnerabilities are listed below, the remaining ones can be found at [1] by expanding the individual advisories. Individual products and their fixed versions: Firefox - 152 [2] Firefox for iOS - 152.0 [3] Firefox ESR 115.37 [4], 140.12 [5] Thunderbird - 152 [6] Thunderbird ESR - 140.12 [7]

Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - privilege escalation (CVE-2026-12289)
CVSS 8.8 (High)

An unauthenticated remote attacker can escalate their privileges due to an unspecified error in the Graphics: WebRender component [8].

The vulnerability is present in products:

  • Mozilla Firefox; <152
  • Mozilla Firefox ESR; >=140, <140.12; >=115, <115.37
  • Mozilla Thunderbird; <152
  • Mozilla Thunderbird ESR; >=140, <140.12

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 6. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - sandbox escape (CVE-2026-12294)
CVSS 7.5 (High)

An attacker can escape the browser sandbox via a vulnerability in the DOM: Workers component [9].

The vulnerability is present in products:

  • Mozilla Firefox; <152
  • Mozilla Firefox ESR; >=140, <140.12; >=115, <115.37
  • Mozilla Thunderbird; <152
  • Mozilla Thunderbird ESR; >=140, <140.12

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 6. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - use-after-free (CVE-2026-12291)
CVSS 7.5 (High)

An attacker can cause the application to crash and potentially execute arbitrary code due to a use-after-free vulnerability in the Networking: HTTP component [10].

The vulnerability is present in products:

  • Mozilla Firefox; <152
  • Mozilla Firefox ESR; >=140, <140.12; >=115, <115.37
  • Mozilla Thunderbird; <152
  • Mozilla Thunderbird ESR; >=140, <140.12

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 6. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - arbitrary code execution (CVE-2026-12328)
CVSS 8.1 (High)

An unauthenticated remote attacker can execute arbitrary code due to memory safety bugs leading to memory corruption [11].

The vulnerability is present in products:

  • Mozilla Firefox; <152
  • Mozilla Firefox ESR; >=140, <140.12; >=115, <115.37
  • Mozilla Thunderbird; <152
  • Mozilla Thunderbird ESR; >=140, <140.12

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-12328 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 16. 6. 2026.

Mozilla Firefox for iOS - arbitrary cookies injection (CVE-2026-53900)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can inject arbitrary cookies into requests sent to an unrelated target domain in Firefox for iOS because cookies are retained when a PDF request is redirected between different domains [12].

The vulnerability is present in product:

  • Firefox for iOS; <152

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 16. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 17. 6. 2026.

CESNET, z.s.p.o. Logo