Threat database

CVE-2026-124949 is a security vulnerability in the SVG component of Mozilla Firefox. It was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact according to the Mozilla advisory. No specific technical details or exploitation methods are provided beyond the general classification as an 'other issue' in the SVG component.

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160.

CVE-2026-124946 is a vulnerability involving an invalid pointer in the JavaScript Engine's Just-In-Time (JIT) compilation component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact severity by Mozilla. No public exploit or active exploitation in the wild has been reported. The vendor advisory confirms the fix and recommends updating to Firefox 160 to remediate the issue.

CVE-2026-124945 is a high-impact vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160. The issue is part of a broader set of high-impact security vulnerabilities resolved in this release.

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160.

CVE-2026-124937 is a security vulnerability affecting the Media component in Firefox for Android. The issue was addressed and fixed in Firefox version 160. The vendor advisory classifies the impact of this and related vulnerabilities as high. No specific technical details or exploitation methods are provided for this particular issue.

CVE-2026-124936 is a spoofing vulnerability in the Address Bar component of Mozilla Firefox. This issue could allow an attacker to mislead users by displaying deceptive information in the browser's address bar. The vulnerability was fixed in Firefox version 160.

CVE-2026-124928 is a mitigation bypass vulnerability in the SVG component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact by Mozilla, indicating serious security concerns if exploited. No public exploit code or in-the-wild exploitation has been reported. Users are advised to update to Firefox 160 or later to remediate this issue.

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160.

CVE-2026-124923 is a sandbox escape vulnerability in the Agent component of Mozilla Firefox. This security flaw allows code running in a restricted sandbox environment to break out of those restrictions. The vulnerability was fixed in Firefox version 160. The impact of this vulnerability is considered high due to the potential for sandbox escape. No public exploit code or in-the-wild exploitation has been reported. Users are advised to update to Firefox 160 or later to remediate this issue.

CVE-2026-124921 is a sandbox escape vulnerability in the Graphics: WebGPU component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 160. The issue allows an attacker to break out of the browser's sandbox environment, potentially leading to unauthorized access or control beyond the browser's normal restrictions.

CVE-2026-124920 is a vulnerability involving uninitialized memory in the Graphics: WebGPU component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 160. The vulnerability is part of a broader set of high-impact security issues resolved in the same Firefox release.

CVE-2026-124911 is a clickjacking vulnerability in the Autofill component of Firefox for Android. This issue was addressed and fixed in Firefox version 160. The vulnerability could potentially allow an attacker to trick users into interacting with hidden or disguised UI elements related to autofill functionality.

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160.

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160.

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160.

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160.

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160.

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160.