Threat database

CVE-2026-124902 is a high-impact vulnerability in Mozilla Firefox that allows bypassing the same-origin policy due to a race condition in the Audio/Video component. This flaw was addressed and fixed in Firefox 160 and Firefox ESR versions 115.45 and 153.7. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Exploitation of this vulnerability could potentially allow unauthorized cross-origin interactions within the browser.

CVE-2026-124901 is a high-impact vulnerability in the Networking: JAR component of Mozilla Firefox. It was fixed in Firefox 160 and Firefox ESR versions 115.45 and 153.7. The issue is part of a broader set of security fixes addressing multiple high-impact vulnerabilities in Firefox. No specific exploitation details or CVSS score are provided.

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124896 is a vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is classified with high impact by Mozilla. No known exploits in the wild have been reported.

Use-after-free in the Storage: localStorage & sessionStorage component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the Networking: Cookies component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Incorrect boundary conditions in the DOM: Selection component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124886 is a vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The issue is part of a set of high-impact vulnerabilities resolved in these releases.

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.