CVE-2026-12290

highcovered by 1 sourcefirst seen 2026-07-10

An attacker can exploit multiple vulnerabilities in Mozilla Firefox, Mozilla Firefox ESR, and Mozilla Thunderbird to execute arbitrary code, gain elevated privileges, cause memory corruption, bypass security measures, escape the sandbox, disclose confidential information, manipulate data, and trigger denial-of-service conditions.

CSIRTS triage

What: Multiple vulnerabilities allow an attacker to execute arbitrary code and gain elevated privileges.
Who is affected: Deployments of Mozilla Firefox, Firefox ESR, and Thunderbird.
Urgency: Remediation is high urgency due to the potential for exploitation.
Action: Update to the latest version of Mozilla Firefox, Firefox ESR, and Thunderbird.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-12290

Get an email if CVE-2026-12290 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Advisory coverage (1)

high[UPDATE] [high] Mozilla Firefox, Firefox ESR and Thunderbird: Multiple vulnerabilitiescert-bund · 2026-07-10

External references

NVD record for CVE-2026-12290

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-12290 status](https://www.csirts.com/badge/CVE-2026-12290)](https://www.csirts.com/cve/CVE-2026-12290)