Search
Find a vulnerability
Search criteria
2587 vulnerabilities found for firefox by mozilla
CVE-2026-124952 (GCVE-0-2026-124952)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:29 – Updated: 2026-11-10 14:19
VLAI
EPSS
VEX
Title
Use-after-free in the Audio/Video component
Summary
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:19 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124952",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:19:47.939195Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:19:55.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "115.45",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "andrew.kemeklis"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45."
}
],
"value": "Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T13:29:02.186Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071647"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-126/"
}
],
"title": "Use-after-free in the Audio/Video component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124952",
"datePublished": "2026-11-10T13:29:02.186Z",
"dateReserved": "2026-11-09T14:48:39.825Z",
"dateUpdated": "2026-11-10T14:19:55.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124950 (GCVE-0-2026-124950)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:29 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Same-origin policy bypass in the CSS Parsing and Computation component
Summary
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Takashi Suzuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:50.602Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083733"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Same-origin policy bypass in the CSS Parsing and Computation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124950",
"datePublished": "2026-11-10T13:29:01.573Z",
"dateReserved": "2026-11-09T14:48:35.014Z",
"dateUpdated": "2026-11-10T18:59:50.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124949 (GCVE-0-2026-124949)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:29 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Other issue in the SVG component
Summary
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:49.369Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082327"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Other issue in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124949",
"datePublished": "2026-11-10T13:29:00.980Z",
"dateReserved": "2026-11-09T14:48:32.986Z",
"dateUpdated": "2026-11-10T18:59:49.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124947 (GCVE-0-2026-124947)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:29 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the Graphics component
Summary
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:42 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:42:11.030608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:45:10.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:48.111Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081249"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Incorrect boundary conditions in the Graphics component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124947",
"datePublished": "2026-11-10T13:29:00.464Z",
"dateReserved": "2026-11-09T14:48:29.193Z",
"dateUpdated": "2026-11-10T18:59:48.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124946 (GCVE-0-2026-124946)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Invalid pointer in the JavaScript Engine: JIT component
Summary
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:46.871Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080789"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Invalid pointer in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124946",
"datePublished": "2026-11-10T13:28:59.792Z",
"dateReserved": "2026-11-09T14:48:26.669Z",
"dateUpdated": "2026-11-10T18:59:46.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124945 (GCVE-0-2026-124945)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Invalid pointer in the Layout: Text and Fonts component
Summary
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:45.604Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080119"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Invalid pointer in the Layout: Text and Fonts component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124945",
"datePublished": "2026-11-10T13:28:59.131Z",
"dateReserved": "2026-11-09T14:48:24.852Z",
"dateUpdated": "2026-11-10T18:59:45.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124944 (GCVE-0-2026-124944)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Information disclosure in the Marionette component
Summary
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:34 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:34:58.705674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:35:25.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:44.374Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079176"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Information disclosure in the Marionette component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124944",
"datePublished": "2026-11-10T13:28:58.581Z",
"dateReserved": "2026-11-09T14:48:23.563Z",
"dateUpdated": "2026-11-10T18:59:44.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124943 (GCVE-0-2026-124943)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the Layout component
Summary
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:27 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124943",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:27:58.910849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:54.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:43.096Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2078990"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the Layout component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124943",
"datePublished": "2026-11-10T13:28:58.030Z",
"dateReserved": "2026-11-09T14:48:21.192Z",
"dateUpdated": "2026-11-10T18:59:43.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124937 (GCVE-0-2026-124937)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 13:28
VLAI
EPSS
VEX
Title
Other issue in the Media component in Firefox for Android
Summary
Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "atrlkwqr"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160."
}
],
"value": "Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T13:28:57.522Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074123"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
}
],
"title": "Other issue in the Media component in Firefox for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124937",
"datePublished": "2026-11-10T13:28:57.522Z",
"dateReserved": "2026-11-09T14:48:06.206Z",
"dateUpdated": "2026-11-10T13:28:57.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124936 (GCVE-0-2026-124936)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Spoofing issue in the Address Bar component
Summary
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Zinnsoldat"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:41.770Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072573"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Spoofing issue in the Address Bar component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124936",
"datePublished": "2026-11-10T13:28:56.914Z",
"dateReserved": "2026-11-09T14:48:03.188Z",
"dateUpdated": "2026-11-10T18:59:41.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124928 (GCVE-0-2026-124928)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Mitigation bypass in the SVG component
Summary
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Takashi Suzuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:40.366Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080652"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Mitigation bypass in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124928",
"datePublished": "2026-11-10T13:28:56.369Z",
"dateReserved": "2026-11-09T14:47:46.681Z",
"dateUpdated": "2026-11-10T18:59:40.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124925 (GCVE-0-2026-124925)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Information disclosure in the Layout component
Summary
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:36 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:36:56.924116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:45:10.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Takashi Suzuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:38.088Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077035"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Information disclosure in the Layout component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124925",
"datePublished": "2026-11-10T13:28:55.828Z",
"dateReserved": "2026-11-09T14:47:40.309Z",
"dateUpdated": "2026-11-10T18:59:38.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124923 (GCVE-0-2026-124923)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Sandbox escape in the Agent component
Summary
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:36.616Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074806"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Sandbox escape in the Agent component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124923",
"datePublished": "2026-11-10T13:28:55.300Z",
"dateReserved": "2026-11-09T14:47:35.760Z",
"dateUpdated": "2026-11-10T18:59:36.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124921 (GCVE-0-2026-124921)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Sandbox escape in the Graphics: WebGPU component
Summary
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:35.386Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073651"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Sandbox escape in the Graphics: WebGPU component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124921",
"datePublished": "2026-11-10T13:28:54.683Z",
"dateReserved": "2026-11-09T14:47:31.955Z",
"dateUpdated": "2026-11-10T18:59:35.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124920 (GCVE-0-2026-124920)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Uninitialized memory in the Graphics: WebGPU component
Summary
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Samuel Erwin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:34.159Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2062097"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Uninitialized memory in the Graphics: WebGPU component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124920",
"datePublished": "2026-11-10T13:28:54.183Z",
"dateReserved": "2026-11-09T14:47:29.958Z",
"dateUpdated": "2026-11-10T18:59:34.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124911 (GCVE-0-2026-124911)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 13:28
VLAI
EPSS
VEX
Title
Clickjacking issue in the Autofill component in Firefox for Android
Summary
Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Riccardo Lamarca"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160."
}
],
"value": "Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T13:28:53.613Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1991276"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
}
],
"title": "Clickjacking issue in the Autofill component in Firefox for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124911",
"datePublished": "2026-11-10T13:28:53.613Z",
"dateReserved": "2026-11-09T14:47:11.223Z",
"dateUpdated": "2026-11-10T13:28:53.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124908 (GCVE-0-2026-124908)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the CSS Parsing and Computation component
Summary
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:28 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:28:12.107669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:54.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:32.922Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2088651"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the CSS Parsing and Computation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124908",
"datePublished": "2026-11-10T13:28:53.034Z",
"dateReserved": "2026-11-09T14:47:04.520Z",
"dateUpdated": "2026-11-10T18:59:32.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124904 (GCVE-0-2026-124904)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the SVG component
Summary
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:28 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124904",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:28:24.594226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:54.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:31.644Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086062"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124904",
"datePublished": "2026-11-10T13:28:52.394Z",
"dateReserved": "2026-11-09T14:46:55.557Z",
"dateUpdated": "2026-11-10T18:59:31.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124900 (GCVE-0-2026-124900)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Sandbox escape due to use-after-free in the DOM: Service Workers component
Summary
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:29 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:29:33.472843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:29:36.132Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:30.407Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083116"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Sandbox escape due to use-after-free in the DOM: Service Workers component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124900",
"datePublished": "2026-11-10T13:28:51.903Z",
"dateReserved": "2026-11-09T14:46:46.705Z",
"dateUpdated": "2026-11-10T18:59:30.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124878 (GCVE-0-2026-124878)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the Layout: Positioned component
Summary
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:28 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124878",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:28:37.115805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:54.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:29.167Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081940"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the Layout: Positioned component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124878",
"datePublished": "2026-11-10T13:28:51.354Z",
"dateReserved": "2026-11-09T14:45:59.657Z",
"dateUpdated": "2026-11-10T18:59:29.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124871 (GCVE-0-2026-124871)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the DOM: HTML Parser component
Summary
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:28 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:28:49.846175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:55.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:27.871Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079678"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the DOM: HTML Parser component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124871",
"datePublished": "2026-11-10T13:28:50.739Z",
"dateReserved": "2026-11-09T14:45:42.535Z",
"dateUpdated": "2026-11-10T18:59:27.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124867 (GCVE-0-2026-124867)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Use-after-free in the DOM: Editor component
Summary
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:29 UTC
CWE
- CWE-416 - Use After Free
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:29:03.352086Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:34:55.188Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:26.625Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079050"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Use-after-free in the DOM: Editor component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124867",
"datePublished": "2026-11-10T13:28:50.140Z",
"dateReserved": "2026-11-09T14:45:34.245Z",
"dateUpdated": "2026-11-10T18:59:26.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124852 (GCVE-0-2026-124852)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 18:59
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the Graphics: CanvasWebGL component
Summary
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:42 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
160 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
160 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:42:23.934908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:45:10.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"value": "Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:59:25.380Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2001244"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
}
],
"title": "Incorrect boundary conditions in the Graphics: CanvasWebGL component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124852",
"datePublished": "2026-11-10T13:28:49.540Z",
"dateReserved": "2026-11-09T14:44:59.189Z",
"dateUpdated": "2026-11-10T18:59:25.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124951 (GCVE-0-2026-124951)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Privilege escalation in the Nimbus Desktop Client component
Summary
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:48.963Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2085124"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Privilege escalation in the Nimbus Desktop Client component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124951",
"datePublished": "2026-11-10T13:28:48.946Z",
"dateReserved": "2026-11-09T14:48:37.018Z",
"dateUpdated": "2026-11-10T20:24:48.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124948 (GCVE-0-2026-124948)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Incorrect boundary conditions, use-after-free in the Graphics component
Summary
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:29 UTC
CWE
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124948",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:29:59.120159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:30:01.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:48.484Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081960"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Incorrect boundary conditions, use-after-free in the Graphics component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124948",
"datePublished": "2026-11-10T13:28:48.375Z",
"dateReserved": "2026-11-09T14:48:31.192Z",
"dateUpdated": "2026-11-10T20:24:48.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124942 (GCVE-0-2026-124942)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Invalid pointer in the DOM: Streams component
Summary
Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:47.990Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077728"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Invalid pointer in the DOM: Streams component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124942",
"datePublished": "2026-11-10T13:28:47.796Z",
"dateReserved": "2026-11-09T14:48:18.992Z",
"dateUpdated": "2026-11-10T20:24:47.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124941 (GCVE-0-2026-124941)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Information disclosure in the Security: RLBox component
Summary
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:37 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-124941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:37:09.450804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:45:10.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shravan Narayan"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:47.481Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077405"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Information disclosure in the Security: RLBox component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124941",
"datePublished": "2026-11-10T13:28:47.308Z",
"dateReserved": "2026-11-09T14:48:15.225Z",
"dateUpdated": "2026-11-10T20:24:47.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124940 (GCVE-0-2026-124940)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Mitigation bypass in the File Handling component
Summary
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Takashi Suzuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:46.944Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076948"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Mitigation bypass in the File Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124940",
"datePublished": "2026-11-10T13:28:46.729Z",
"dateReserved": "2026-11-09T14:48:12.627Z",
"dateUpdated": "2026-11-10T20:24:46.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124939 (GCVE-0-2026-124939)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
JIT miscompilation in the JavaScript Engine: JIT component
Summary
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "SecBuddyN, Tencent KeenLab (CodeBuddy Security)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:46.391Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076663"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "JIT miscompilation in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124939",
"datePublished": "2026-11-10T13:28:46.139Z",
"dateReserved": "2026-11-09T14:48:10.218Z",
"dateUpdated": "2026-11-10T20:24:46.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124938 (GCVE-0-2026-124938)
Vulnerability from cvelistv5 – Published: 2026-11-10 13:28 – Updated: 2026-11-10 20:24
VLAI
EPSS
VEX
Title
Mitigation bypass in the Add-ons Manager component
Summary
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Severity
No CVSS data available.
Assigner
mozilla
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.7 , ≤ 153.*
(rpm)
Unaffected: 160 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.7",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "160",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Tuan Hung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"value": "Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:24:45.884Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075948"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-125/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-127/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-128/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-129/"
}
],
"title": "Mitigation bypass in the Add-ons Manager component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-124938",
"datePublished": "2026-11-10T13:28:45.588Z",
"dateReserved": "2026-11-09T14:48:08.412Z",
"dateUpdated": "2026-11-10T20:24:45.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}