Threat database

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160.

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160.

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160.

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160.

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160.

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160.

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160.

CVE-2026-124951 is a privilege escalation vulnerability in the Nimbus Desktop Client component of Mozilla Firefox. This security flaw allows an attacker to gain elevated privileges within the affected component. The issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. No known exploits in the wild have been reported. The vulnerability is considered high impact due to the potential for privilege escalation.

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124942 is a vulnerability involving an invalid pointer in the DOM Streams component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is classified with high impact by Mozilla. No known exploits in the wild have been reported.

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124940 is a mitigation bypass vulnerability in the File Handling component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could allow an attacker to bypass security mitigations related to file handling within the browser.

CVE-2026-124939 is a vulnerability involving just-in-time (JIT) miscompilation in the JavaScript engine's JIT component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is part of a set of high-impact security issues resolved in the same release cycle.

CVE-2026-124938 is a mitigation bypass vulnerability in the Add-ons Manager component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could allow attackers to bypass security mitigations related to add-ons management.

CVE-2026-124935 is an undefined behavior vulnerability in the WebRTC Networking component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is part of a broader set of high-impact security fixes released by Mozilla. No public exploit or active exploitation is currently known.

CVE-2026-124934 is a spoofing vulnerability in the Security component of Mozilla Firefox. The issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. No active exploitation in the wild has been reported. The vulnerability is part of a set of high-impact security fixes released by Mozilla.

CVE-2026-124933 is a sandbox escape vulnerability in the Console component of Mozilla Firefox. This security flaw allows code running in a restricted sandbox environment to break out of those restrictions, potentially leading to unauthorized actions. The vulnerability was addressed and fixed in Firefox version 160 and Firefox ESR 153.7.

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124931 is a same-origin policy bypass vulnerability in the DOM: Core & HTML component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox 160 and Firefox ESR 153.7. The vulnerability could allow unauthorized access to web content that should be restricted by the same-origin policy.

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.