PT-2026-49658 · Mozilla+1 · Firefox+3

Choeseyeong · CVE-2026-12289 · Published 2026-06-16 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 152 Firefox ESR versions prior to 140.12 Firefox ESR versions prior to 115.37 Thunderbird versions prior to 152 Thunderbird versions prior to 140.12

Description Privilege escalation is possible within the Graphics: WebRender component.

Recommendations Update to version 152 for Firefox. Update to version 140.12 for Firefox ESR. Update to version 115.37 for Firefox ESR. Update to version 152 for Thunderbird. Update to version 140.12 for Thunderbird.

Fix

LPE

DoS

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

ALSA-2026:27717

ALSA-2026:27733

ALSA-2026:27734

ALSA-2026:29940

ALSA-2026:30846

ALSA-2026:33445

CVE-2026-12289

OESA-2026-2735

OPENSUSE-SU-2026:11052-1

OPENSUSE-SU-2026:11055-1

OPENSUSE-SU-2026:11072-1

OPENSUSE-SU-2026:21043-1

OPENSUSE-SU-2026:21168-1

RHSA-2026:27717

RHSA-2026:27733

RHSA-2026:27734

RHSA-2026:29940

RHSA-2026:30846

RHSA-2026:33445

RHSA-2026:36100

RHSA-2026:36101

RHSA-2026:36102

RHSA-2026:36103

RHSA-2026:37210

RHSA-2026:37391

RHSA-2026:38506

RHSA-2026:38750

RHSA-2026:38751

RHSA-2026:38753

RHSA-2026:39011

RHSA-2026:39141

RHSA-2026:39142

RHSA-2026:39428

RHSA-2026:39706

SUSE-SU-2026:22351-1

SUSE-SU-2026:2582-1

SUSE-SU-2026:2583-1

SUSE-SU-2026:2814-1

SUSE-SU-2026:2852-1

Affected Products

Firefox

Firefox Esr

Rocky Linux

Thunderbird

References · 251

• https://nvd.nist.gov/vuln/detail/CVE-2026-12291 · Security Note
• https://ubuntu.com/security/CVE-2026-12289 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:29940 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30846 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2583-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11052-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12306 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-12305 · Security Note
• https://access.redhat.com/errata/RHSA-2026:36100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12299 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-33445.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12308 · Security Note
• https://access.redhat.com/errata/RHSA-2026:27733 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22351-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12296 · Security Note