{"id":"CVE-2026-124862","kind":"vulnerability","aliases":["CVE-2026-124862"],"related":[],"title":"Firefox: use-after-free in DOM core lets memory be corrupted","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 160 and Firefox ESR 153.7. The sources do not say what an attacker can achieve with it beyond the memory corruption class.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-updated"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare it with `160` (Firefox) and `153.7` (Firefox ESR)","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","triaged_at":"2026-11-10T14:26:36+00:00","updated_at":"2026-11-10T14:26:36+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: use-after-free in DOM core lets memory be corrupted","impact":"high","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 160 and Firefox ESR 153.7. The sources do not say what an attacker can achieve with it beyond the memory corruption class.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, sources do not say more","analyst_note":"Check Mozilla's Firefox 160 release notes and the NVD entry for CVE-2026-124862 to confirm exploitability, trigger conditions and whether it is in the wild.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare it with `160` (Firefox) and `153.7` (Firefox ESR)","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox builds older than 160, or Firefox ESR older than 153.7. Systems on managed or auto-updating Firefox are typically covered once updated. The sources do not describe a non-default configuration that is required.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000747,"input_tokens":4478,"output_tokens":598,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124862':15A,18A '-2026':14A,17A '153.7':47B,85C '160':43B,81C 'achiev':57B 'attack':55B 'beyond':60B 'browser':20B 'bug':29B 'class':64B 'compon':36B,74C 'core':8A,33B,72C 'corrupt':12A,63B 'cve':13A,16A 'desktop':21B 'dom':7A,32B,71C 'esr':46B,84C 'firefox':1A,19A,22B,38B,42B,45B,80C,83C 'fix':40B,78C 'free':5A,28B,68C 'html':35B,73C 'let':9A 'memori':10A,62B 'runtim':23B 'say':52B 'sourc':49B 'use':3A,26B,66C 'use-after-fre':2A,25B,65C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 160, or Firefox ESR older than 153.7. Systems on managed or auto-updating Firefox are typically covered once updated. The sources do not describe a non-default configuration that is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","desktop","firefox","runtime","unknown","vendor"],"campaign_type":null,"search_a":"'-124862':15A,18A '-2026':14A,17A 'core':8A 'corrupt':12A 'cve':13A,16A 'dom':7A 'firefox':1A,19A 'free':5A 'let':9A 'memori':10A 'use':3A 'use-after-fre':2A","search_b":"'153.7':47B '160':43B 'achiev':57B 'attack':55B 'beyond':60B 'browser':20B 'bug':29B 'class':64B 'compon':36B 'core':33B 'corrupt':63B 'desktop':21B 'dom':32B 'esr':46B 'firefox':22B,38B,42B,45B 'fix':40B 'free':28B 'html':35B 'memori':62B 'runtim':23B 'say':52B 'sourc':49B 'use':26B 'use-after-fre':25B","search_c":"'153.7':85C '160':81C 'compon':74C 'core':72C 'dom':71C 'esr':84C 'firefox':80C,83C 'fix':78C 'free':68C 'html':73C 'use':66C 'use-after-fre':65C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124862","severity":null,"published_at":"2026-11-10T14:17:18+00:00","modified_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","fetched_at":"2026-11-10T14:22:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}