CVE-2026-124917
UnknownSummary
Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Risk Assessment
A sandbox escape may allow an attacker to access resources outside the isolated process. This increases the risk of full system compromise.
Recommendation
Update Firefox to version 160 or Firefox ESR to version 153.7. Given the nature of the vulnerability, treat the update as a priority.
Other vulnerabilities in Firefox
See all- CVE-2026-124951Unknown
Privilege escalation vulnerability in the Nimbus Desktop Client component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124950Unknown
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124949Unknown
An unspecified vulnerability in the SVG component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124948High
Vulnerability caused by incorrect boundary conditions and use-after-free in the Graphics component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124947High
Vulnerability caused by incorrect boundary conditions in the Graphics component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124946Unknown
Invalid pointer vulnerability in the JavaScript Engine: JIT component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124945Unknown
Invalid pointer vulnerability in the Layout: Text and Fonts component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124944Medium
Information disclosure vulnerability in the Marionette component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124943High
Use-after-free vulnerability in the Layout component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124942Unknown
Invalid pointer in the DOM: Streams component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Original NVD description (English source)
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS