FIREFOX · CVE-2026-124861 · Runtime
NO FIX YET · SEE WHAT TO DO
A use-after-free bug in Firefox's Audio/Video cubeb component allows a sandbox escape. A successful attack lets malicious code get past the browser's sandbox protections.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running a Firefox build older than the fixed versions, on desktop or in environments that use Firefox for browsing. The sources do not describe the trigger in detail, so unknown whether a page visit alone is enough.
Not affected if up-to-date-firefox
Who cares browsers, desktop, firefox
about:support or Help > About Firefox.160 on the current branch, below 153.7 on ESR 153, or below 115.45 on ESR 115.160115.45153.7Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.