{"id":"CVE-2026-124867","kind":"vulnerability","aliases":["CVE-2026-124867"],"related":[],"title":"Firefox: use-after-free in the DOM Editor component, possible code execution","description":"Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160.","summary":"A use-after-free bug in the DOM Editor component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker gets beyond this, so impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["firefox","runtime"],"not_affected_if":[],"how_to_check":"- Check the Firefox version with `about:support` or the Help menu; the sources say the bug was fixed in Firefox 160.","fix":"- Firefox: move to `160` or later, per the sources.","status":"open","published_at":"2026-11-10T14:17:19+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","triaged_at":"2026-11-10T14:26:28+00:00","updated_at":"2026-11-10T14:26:28+00:00","category":"runtime","confidence":0.45,"triage":{"at":"2026-11-10T14:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later, per the sources.","reach":"unknown","title":"Firefox: use-after-free in the DOM Editor component, possible code execution","impact":"medium","summary":"A use-after-free bug in the DOM Editor component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker gets beyond this, so impact is unconfirmed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox"],"confidence":0.45,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm exploitability and reach from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124867 and Mozilla's advisory for Firefox 160.","how_to_check":"- Check the Firefox version with `about:support` or the Help menu; the sources say the bug was fixed in Firefox 160.","plain_action":"Update Firefox to version 160 or later: Menu > Help > About Firefox.","product_name":"Firefox","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4459,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124867':16A,19A '-2026':15A,18A '160':74C 'attack':51B 'beyond':53B 'bug':28B 'code':12A 'compon':10A,33B,67C 'cve':14A,17A 'dom':8A,31B,65C 'editor':9A,32B,66C 'execut':13A 'firefox':1A,20A,21B,35B,73C 'fix':71C 'free':5A,27B,62C 'freed':43B 'get':52B 'impact':56B 'let':36B 'memori':37B 'possibl':11A 'reus':39B 'runtim':22B 'sourc':45B 'state':48B 'unconfirm':58B 'use':3A,25B,60C 'use-after-fre':2A,24B,59C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: Menu > Help > About Firefox.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["firefox","runtime","unknown","vendor"],"campaign_type":null,"search_a":"'-124867':16A,19A '-2026':15A,18A 'code':12A 'compon':10A 'cve':14A,17A 'dom':8A 'editor':9A 'execut':13A 'firefox':1A,20A 'free':5A 'possibl':11A 'use':3A 'use-after-fre':2A","search_b":"'attack':51B 'beyond':53B 'bug':28B 'compon':33B 'dom':31B 'editor':32B 'firefox':21B,35B 'free':27B 'freed':43B 'get':52B 'impact':56B 'let':36B 'memori':37B 'reus':39B 'runtim':22B 'sourc':45B 'state':48B 'unconfirm':58B 'use':25B 'use-after-fre':24B","search_c":"'160':74C 'compon':67C 'dom':65C 'editor':66C 'firefox':73C 'fix':71C 'free':62C 'use':60C 'use-after-fre':59C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124867","severity":null,"published_at":"2026-11-10T14:17:19+00:00","modified_at":"2026-11-10T14:17:19+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","fetched_at":"2026-11-10T14:22:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}