Threat database

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160.

CVE-2026-124951 is a privilege escalation vulnerability in the Nimbus Desktop Client component of Mozilla Firefox. This security flaw allows an attacker to gain elevated privileges within the affected component. The issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. No known exploits in the wild have been reported. The vulnerability is considered high impact due to the potential for privilege escalation.

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124942 is a vulnerability involving an invalid pointer in the DOM Streams component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is classified with high impact by Mozilla. No known exploits in the wild have been reported.

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124940 is a mitigation bypass vulnerability in the File Handling component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could allow an attacker to bypass security mitigations related to file handling within the browser.

CVE-2026-124939 is a vulnerability involving just-in-time (JIT) miscompilation in the JavaScript engine's JIT component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is part of a set of high-impact security issues resolved in the same release cycle.

CVE-2026-124938 is a mitigation bypass vulnerability in the Add-ons Manager component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could allow attackers to bypass security mitigations related to add-ons management.

CVE-2026-124935 is an undefined behavior vulnerability in the WebRTC Networking component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is part of a broader set of high-impact security fixes released by Mozilla. No public exploit or active exploitation is currently known.

CVE-2026-124934 is a spoofing vulnerability in the Security component of Mozilla Firefox. The issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. No active exploitation in the wild has been reported. The vulnerability is part of a set of high-impact security fixes released by Mozilla.

CVE-2026-124933 is a sandbox escape vulnerability in the Console component of Mozilla Firefox. This security flaw allows code running in a restricted sandbox environment to break out of those restrictions, potentially leading to unauthorized actions. The vulnerability was addressed and fixed in Firefox version 160 and Firefox ESR 153.7.

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124931 is a same-origin policy bypass vulnerability in the DOM: Core & HTML component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox 160 and Firefox ESR 153.7. The vulnerability could allow unauthorized access to web content that should be restricted by the same-origin policy.

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124927 is a site isolation vulnerability in the Graphics: WebRender component of Mozilla Firefox. This security issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could potentially impact the browser's graphics rendering isolation, but no specific exploitation details or active exploits are reported.

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.