CVE-2026-12302

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2034489Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-57/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-58/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-59/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-60/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-61/Vendor Advisory

Timeline

Published: Jun 16, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1230206.3A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_promp CVE-2026-1230227.3A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src CVE-2026-1230237.3A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_CVE-2026-1230247.3A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agent CVE-2026-1230259.4An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through CVE-2026-1230287.3A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admi CVE-2026-1230297.5Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges CVE-2026-123034.3Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 a CVE-2026-1230327.3A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function CVE-2026-1230338.3Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their re CVE-2026-1230365.5A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `except CVE-2026-1230376.7A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks