CVE-2026-12315

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2042058Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-57/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-58/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-60/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-61/Vendor Advisory

Timeline

Published: Jun 16, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1231517.5A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffe CVE-2026-1231588.1sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related CVE-2026-123169.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-123177.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231778.4A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged CVE-2026-1231784.5An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to t CVE-2026-1231795.5An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 all CVE-2026-123187.3Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231808.8A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi ne CVE-2026-1231815.5A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with adminis CVE-2026-1231835.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCo CVE-2026-1231848.1An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a projec