---
id: "CVE-2026-124855"
page: "https://infrastack.ai/live/CVE-2026-124855"
kind: "vulnerability"
aliases: ["CVE-2026-124855"]
title: "Firefox: DOM navigation sandbox escape fixed in versions 160 and ESR 153.7"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["browser", "firefox", "runtime"]
not_affected_if: ["firefox-already-updated"]
published_at: "2026-11-10T14:17:17+00:00"
first_seen_at: "2026-11-10T14:22:13+00:00"
updated_at: "2026-11-10T14:26:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124855", "first_seen_at": "2026-11-10T14:22:13+00:00"}]
exploit_sources: []
---

# Firefox: DOM navigation sandbox escape fixed in versions 160 and ESR 153.7

Link for people: https://infrastack.ai/live/CVE-2026-124855 (this .md is for agents)

A flaw in the Navigation component of the DOM lets content escape the browser sandbox, according to the advisory text. The source says it was fixed in Firefox 160 and Firefox ESR 153.7, but does not say what an attacker gets beyond escaping the sandbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`
- Compare it against `160` for Firefox and `153.7` for Firefox ESR

## Fix

- Firefox: `160`
- Firefox ESR: `153.7`

## Timeline

- 2026-11-10T14:22:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124855

## From the sources

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_