CVE-2026-124950
UnknownSummary
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. It was fixed in Firefox 160.
Risk Assessment
Bypassing the same-origin policy may allow access to data from other sites and break content isolation. It increases the risk of session data theft or cross-site attacks.
Recommendation
Update Firefox to version 160 or later. After updating, re-login to web applications to refresh sessions.
Other vulnerabilities in Firefox
See all- CVE-2026-124951Unknown
Privilege escalation vulnerability in the Nimbus Desktop Client component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124949Unknown
An unspecified vulnerability in the SVG component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124948High
Vulnerability caused by incorrect boundary conditions and use-after-free in the Graphics component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124947High
Vulnerability caused by incorrect boundary conditions in the Graphics component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124946Unknown
Invalid pointer vulnerability in the JavaScript Engine: JIT component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124945Unknown
Invalid pointer vulnerability in the Layout: Text and Fonts component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124944Medium
Information disclosure vulnerability in the Marionette component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124943High
Use-after-free vulnerability in the Layout component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124942Unknown
Invalid pointer in the DOM: Streams component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124941Medium
Information disclosure in the Security: RLBox component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Original NVD description (English source)
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS