CVE-2026-12294

Vulnerability

CVE-2026-12294 is a sandbox escape vulnerability in the DOM: Workers component of Firefox. It allows a Web Worker to break out of its sandbox restrictions. The vulnerability affects Firefox versions prior to 152, Firefox ESR versions prior to 140.12, and Firefox ESR versions prior to 115.37 [1][2][3].

Exploitation

An attacker would first need to execute or inject a malicious Web Worker script into a target browser session. This could be achieved by convincing a user to visit a specially crafted website or by compromising a legitimate site to serve malicious worker code. The malicious worker then exploits the flaw to escape the intended sandbox boundaries [1].

Impact

Successful exploitation results in a sandbox escape, allowing the attacker's code to run with the privileges of the host Firefox process. This can lead to arbitrary code execution on the user's system, bypassing the security boundaries intended for Web Workers [1][2][3].

Mitigation

The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, all released on June 16, 2026 [1][2][3]. Users should update to these versions or later. No workarounds are available.