CVE-2026-124900
UnknownSummary
A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.
Risk Assessment
A sandbox escape can enable code execution outside the browser's isolation boundary, posing a serious threat to workstations. It requires user interaction with a malicious page.
Recommendation
Update Firefox to version 160 or later. Prioritize workstations that browse untrusted content.
Other vulnerabilities in Firefox
See all- CVE-2026-124951Unknown
Privilege escalation vulnerability in the Nimbus Desktop Client component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124950Unknown
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124949Unknown
An unspecified vulnerability in the SVG component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124948High
Vulnerability caused by incorrect boundary conditions and use-after-free in the Graphics component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124947High
Vulnerability caused by incorrect boundary conditions in the Graphics component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124946Unknown
Invalid pointer vulnerability in the JavaScript Engine: JIT component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124945Unknown
Invalid pointer vulnerability in the Layout: Text and Fonts component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124944Medium
Information disclosure vulnerability in the Marionette component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124943High
Use-after-free vulnerability in the Layout component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124942Unknown
Invalid pointer in the DOM: Streams component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Original NVD description (English source)
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS