CVE-2026-124861
UnknownSummary
Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Risk Assessment
A sandbox escape may allow a malicious page to gain broader privileges on the system. This poses a serious threat to workstation security.
Recommendation
Immediately update Firefox to version 160 or ESR 115.45 / 153.7. Prioritize systems with access to sensitive data.
Other vulnerabilities in Firefox
See all- CVE-2026-124951Unknown
Privilege escalation vulnerability in the Nimbus Desktop Client component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124950Unknown
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124949Unknown
An unspecified vulnerability in the SVG component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124948High
Vulnerability caused by incorrect boundary conditions and use-after-free in the Graphics component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124947High
Vulnerability caused by incorrect boundary conditions in the Graphics component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124946Unknown
Invalid pointer vulnerability in the JavaScript Engine: JIT component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124945Unknown
Invalid pointer vulnerability in the Layout: Text and Fonts component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124944Medium
Information disclosure vulnerability in the Marionette component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124943High
Use-after-free vulnerability in the Layout component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124942Unknown
Invalid pointer in the DOM: Streams component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Original NVD description (English source)
Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS