CVE-2026-12309mediumCWE-119

CVE-2026-12309: medium-severity vulnerability in Mozilla Firefox

Memory safety bug fixed in Firefox 152

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.2%
exploitation probability
0.2%top 87% of all CVEs
observed exploitation
nono source reports it
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected products
Mozilla · FirefoxMozilla · Thunderbird
Related CVEs — Mozilla Firefox

In the same product, most dangerous first.

CVE-2016-9079HIGHCVE-2016-9079EPSS 87.5%KEVCVE-2019-11708CRITICALCVE-2019-11708EPSS 55.9%KEVCVE-2019-17026HIGHCVE-2019-17026EPSS 46.3%KEVCVE-2019-11707HIGHCVE-2019-11707EPSS 37.7%KEVCVE-2024-9680CRITICALCVE-2024-9680EPSS 23.2%KEVCVE-2022-26485HIGHCVE-2022-26485EPSS 14.3%KEV
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2038476https://www.mozilla.org/security/advisories/mfsa2026-57/https://www.mozilla.org/security/advisories/mfsa2026-58/https://www.mozilla.org/security/advisories/mfsa2026-60/https://www.mozilla.org/security/advisories/mfsa2026-61/