Threat database

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124914 is a site isolation issue in the DOM Navigation component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The issue relates to improper site isolation, which can affect the browser's security boundary enforcement.

CVE-2026-124913 is a site isolation vulnerability in the Networking component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is part of a set of high-impact security issues resolved in the same release. No known exploits in the wild have been reported.

CVE-2026-124912 is a spoofing vulnerability in the DOM security component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could allow an attacker to spoof content within the Document Object Model, potentially misleading users or bypassing security checks.

CVE-2026-124910 is a mitigation bypass vulnerability in the WebExtensions component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability could potentially allow attackers to bypass security mitigations implemented in the WebExtensions framework.

Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

Use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124905 is a high-impact sandbox escape vulnerability in the DOM Navigation component of Mozilla Firefox. It allows an attacker to escape the browser's sandbox environment, potentially leading to unauthorized code execution or privilege escalation. This vulnerability was fixed in Firefox 160 and Firefox ESR versions 115.45 and 153.7.

Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

CVE-2026-124902 is a high-impact vulnerability in Mozilla Firefox that allows bypassing the same-origin policy due to a race condition in the Audio/Video component. This flaw was addressed and fixed in Firefox 160 and Firefox ESR versions 115.45 and 153.7. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Exploitation of this vulnerability could potentially allow unauthorized cross-origin interactions within the browser.

CVE-2026-124901 is a high-impact vulnerability in the Networking: JAR component of Mozilla Firefox. It was fixed in Firefox 160 and Firefox ESR versions 115.45 and 153.7. The issue is part of a broader set of security fixes addressing multiple high-impact vulnerabilities in Firefox. No specific exploitation details or CVSS score are provided.

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

CVE-2026-124896 is a vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability is classified with high impact by Mozilla. No known exploits in the wild have been reported.

Use-after-free in the Storage: localStorage & sessionStorage component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free in the Networking: Cookies component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.