{"id":"CVE-2026-124864","kind":"vulnerability","aliases":["CVE-2026-124864"],"related":[],"title":"Firefox: use-after-free in Service Workers lets web content escape the sandbox","description":"Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in the Service Workers component of Firefox's DOM lets malicious web content escape the browser sandbox. An attacker who gets a user to visit a crafted page could run code outside the sandboxed content process.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["patched-version"],"how_to_check":"- Check the Firefox version in Help > About Firefox, or run `firefox --version` on the machine.\n- Confirm the installed version is below `160` for Firefox or below `115.45` / `153.7` for the ESR branches.","fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","status":"open","published_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","triaged_at":"2026-11-10T14:26:31+00:00","updated_at":"2026-11-10T14:26:31+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T14:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","reach":"internet","title":"Firefox: use-after-free in Service Workers lets web content escape the sandbox","impact":"high","summary":"A use-after-free bug in the Service Workers component of Firefox's DOM lets malicious web content escape the browser sandbox. An attacker who gets a user to visit a crafted page could run code outside the sandboxed content process.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"malicious web page escapes sandbox and runs code on the machine","analyst_note":"","how_to_check":"- Check the Firefox version in Help > About Firefox, or run `firefox --version` on the machine.\n- Confirm the installed version is below `160` for Firefox or below `115.45` / `153.7` for the ESR branches.","plain_action":"Update Firefox to version 160, or to ESR 115.45 or 153.7 if you use the ESR release.","product_name":"","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Anyone running a Firefox build older than the fixed versions who browses the web with Service Workers enabled, which is the default. Managed deployments using the ESR channel should check against the ESR fixed versions. Users who only run a patched version are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4504,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124864':17A,20A '-2026':16A,19A '115.45':90C '153.7':94C '160':87C 'attack':49B 'browser':21B,46B 'bug':30B 'code':61B 'compon':35B,80C 'content':11A,43B,65B 'could':59B 'craft':57B 'cve':15A,18A 'desktop':22B 'dom':39B,77C 'due':69C 'escap':12A,44B,68C 'esr':89C,93C 'firefox':1A,23B,37B,86C,88C,92C 'fix':84C 'free':5A,29B,74C 'get':51B 'let':9A,40B 'malici':41B 'outsid':62B 'page':58B 'process':66B 'run':60B 'runtim':24B 'sandbox':14A,47B,64B,67C 'servic':7A,33B,78C 'use':3A,27B,72C 'use-after-fre':2A,26B,71C 'user':53B 'visit':55B 'vulner':82C 'web':10A,42B 'worker':8A,34B,79C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than the fixed versions who browses the web with Service Workers enabled, which is the default. Managed deployments using the ESR channel should check against the ESR fixed versions. Users who only run a patched version are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160, or to ESR 115.45 or 153.7 if you use the ESR release.","pkeys":[],"ptokens":[],"labels":["browsers","desktop","firefox","high","runtime"],"campaign_type":null,"search_a":"'-124864':17A,20A '-2026':16A,19A 'content':11A 'cve':15A,18A 'escap':12A 'firefox':1A 'free':5A 'let':9A 'sandbox':14A 'servic':7A 'use':3A 'use-after-fre':2A 'web':10A 'worker':8A","search_b":"'attack':49B 'browser':21B,46B 'bug':30B 'code':61B 'compon':35B 'content':43B,65B 'could':59B 'craft':57B 'desktop':22B 'dom':39B 'escap':44B 'firefox':23B,37B 'free':29B 'get':51B 'let':40B 'malici':41B 'outsid':62B 'page':58B 'process':66B 'run':60B 'runtim':24B 'sandbox':47B,64B 'servic':33B 'use':27B 'use-after-fre':26B 'user':53B 'visit':55B 'web':42B 'worker':34B","search_c":"'115.45':90C '153.7':94C '160':87C 'compon':80C 'dom':77C 'due':69C 'escap':68C 'esr':89C,93C 'firefox':86C,88C,92C 'fix':84C 'free':74C 'sandbox':67C 'servic':78C 'use':72C 'use-after-fre':71C 'vulner':82C 'worker':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124864","severity":null,"published_at":"2026-11-10T14:17:18+00:00","modified_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","fetched_at":"2026-11-10T14:22:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}