Multiple Vulnerabilities in Firefox 152 Enable Remote Code Execution and Sandbox Escape (MFSA 2026-57) — Threadlinqs Intelligence
As of 2026-06-18, Multiple Vulnerabilities in Firefox 152 Enable Remote Code Execution and Sandbox Escape (MFSA 2026-57) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0855 · Severity: HIGH · Status: PATCHED · Category: VULNERABILITY
Mozilla's MFSA 2026-57 advisory fixes 39 vulnerabilities in Firefox 152, including use-after-free, memory-safety/corruption, JIT miscompilation, and four distinct sandbox-escape flaws that, chained,
On June 16, 2026 Mozilla published Security Advisory MFSA 2026-57, addressing 39 vulnerabilities in Firefox 152 (with parallel fixes in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 152). The advisory is dominated by classic browser memory-safety issues reachable from untrusted web content over the network attack vector, requiring only that a user visit or render a malicious page (drive-by / client-side execution).
The highest-impact issues are a use-after-free in the HTTP networking stack (CVE-2026-12291) and a use-after-free in the WebGPU graphics subsystem (CVE-2026-12293), both leading to memory corruption that can be leveraged for arbitrary code execution inside the content process. A JIT miscompilation in DOM: Core & HTML (CVE-2026-12299) produces unpredictable execution behavior that can bypass memory protections, and a WebAssembly JIT miscompilation (CVE-2026-12321) is also fixed. Multiple aggregate memory-safety roll-up bugs (CVE-2026-12290, 12298, 12326, 12328) carry High impact and are described by Mozilla as showing evidence of memory corruption that, with sufficient effort, could be exploited to run arbitrary code.
Four High-severity sandbox-escape vulnerabilities are the most strategically significant: CVE-2026-12294 (DOM: Workers), CVE-2026-12295 (DOM: Navigation), CVE-2026-12296 (Security: Process Sandboxing), and CVE-2026-12297 (incorrect boundary conditions in Networking). A real-world exploit chain pairs one of the content-process memory-corruption primitives (e.g., the HTTP or WebGPU UAF) with a sandbox escape to break out of the renderer/content sandbox and interact with the underlying operating system, and optionally CVE-2026-12289 (privilege escalation in Graphics: WebRender) to elevate privileges on the host. Additional issues include same-origin-policy bypass via cookie handling (CVE-2026-12304), DOM security mitigation bypasses (CVE-2026-12302, 12315, 12316), information disclosure paired with sandbox escape (CVE-2026-12311, 12313), WebGPU information disclosure (CVE-2026-12303), Password Manager information disclosure (CVE-2026-12320), GTK widget clickjacking (CVE-2026-12322), DOM spoofing (CVE-2026-12323), and several denial-of-service flaws in media playback (CVE-2026-12319) and graphics/ImageLib (CVE-2026-12325).
Mozilla provided no CVSS base scores in the advisory and there is no public proof-of-concept or confirmed in-the-wild exploitation reported in the source material; severity is therefore tracked using Mozilla's own High/Moderate/Low impact ratings. Given the demonstrated RCE-plus-sandbox-escape potential against one of the most widely deployed browsers, organizations should treat patch rollout to Firefox 152 / ESR 140.12 / ESR 115.37 / Thunderbird 152 as a priority.
Weaknesses (CWE)
CWE-416, CWE-787, CWE-125, CWE-119, CWE-843, CWE-693, CWE-346, CWE-200, CWE-269, CWE-400
Target sectors: all sectors, enterprise, government, financial, technology
Target regions: Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-12289, CVE-2026-12290, CVE-2026-12291, CVE-2026-12292, CVE-2026-12293, CVE-2026-12294, CVE-2026-12295, CVE-2026-12296, CVE-2026-12297, CVE-2026-12298, T1592.002, T1189, T1566.002, T1203, T1204.001, T1059.007, T1068, T1211, T1555.003, T1212
