CVE-2026-12322
published 2026-06-16CVE-2026-12322: Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
PriorityP424medium5.4CVSS 3.1
AVNACLPRNUIRSUCLINAL
EPSS
0.21%
10.3th percentile
Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 152 | Firefox 152 |
| mozilla | firefox | < 152.0.0 | 152.0.0 |
| mozilla | thunderbird | < Thunderbird 152 | Thunderbird 152 |
| mozilla | thunderbird | < 152.0.0 | 152.0.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
vendor_redhat·2026-06-16·CVSS 5.4
CVE-2026-12322 [MEDIUM] CWE-1021 firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Clickjacking issue in the Widget: Gtk component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat En
Mozilla
Mozilla Foundation Security Advisory 2026-57: CVE-2026-12322
vendor_mozilla·CVSS 5.4
CVE-2026-12322 [MEDIUM] Mozilla Foundation Security Advisory 2026-57: CVE-2026-12322
Mozilla Foundation Security Advisory 2026-57
CVE: CVE-2026-12322
Product: Firefox
Impact: high
Fixed in: Firefox 152
Mozilla
Mozilla Foundation Security Advisory 2026-60: CVE-2026-12322
vendor_mozilla·CVSS 5.4
CVE-2026-12322 [MEDIUM] Mozilla Foundation Security Advisory 2026-60: CVE-2026-12322
Mozilla Foundation Security Advisory 2026-60
CVE: CVE-2026-12322
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 152
VulDB
Mozilla Firefox up to 151 Gtk clickjacking (Nessus ID 321405 / WID-SEC-2026-1959)
vuldb·2026-07-10·CVSS 5.4
CVE-2026-12322 [MEDIUM] Mozilla Firefox up to 151 Gtk clickjacking (Nessus ID 321405 / WID-SEC-2026-1959)
A vulnerability was found in Mozilla Firefox up to 151. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component Gtk. The manipulation leads to clickjacking.
This vulnerability is uniquely identified as CVE-2026-12322. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
Clickjacking issue in the Widget: Gtk component.
ghsa_unreviewed·2026-06-16
CVE-2026-12322 [MEDIUM] CWE-1021 Clickjacking issue in the Widget: Gtk component.
Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12322 firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
bugzilla·2026-06-16·CVSS 5.4
CVE-2026-12322 [MEDIUM] CVE-2026-12322 firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
CVE-2026-12322 firefox: thunderbird: Clickjacking issue in the Widget: Gtk component
Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152.
Bugzilla
[Linux] GTK file picker on older branches or with dbus unavailable/failing can cause held-down Enter key to lead to file upload due to default selection and accept button focus
bugzilla·2026-04-21
CVE-2026-12322 [Linux] GTK file picker on older branches or with dbus unavailable/failing can cause held-down Enter key to lead to file upload due to default selection and accept button focus
[Linux] GTK file picker on older branches or with dbus unavailable/failing can cause held-down Enter key to lead to file upload due to default selection and accept button focus
Created attachment 9572134
PoC.tar.gz
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Steps to reproduce:
1. Navigate to any site supporting file upload (e.g., https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/input/file#using_file_inputs)
2. Upload any file from a local directory. This simulates a prior legitimate upload by the victim on any origin.
3. Navigate to an attacker-controlled page containing a hidden and a keydown listener on 'Enter' that programmatically calls .click() on the file input.
4. Hold the Enter key on
2026-06-16
Published