---
id: "CVE-2026-124867"
page: "https://infrastack.ai/live/CVE-2026-124867"
kind: "vulnerability"
aliases: ["CVE-2026-124867"]
title: "Firefox: use-after-free in the DOM Editor component, possible code execution"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["firefox", "runtime"]
not_affected_if: []
published_at: "2026-11-10T14:17:19+00:00"
first_seen_at: "2026-11-10T14:22:14+00:00"
updated_at: "2026-11-10T14:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124867", "first_seen_at": "2026-11-10T14:22:14+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in the DOM Editor component, possible code execution

Link for people: https://infrastack.ai/live/CVE-2026-124867 (this .md is for agents)

A use-after-free bug in the DOM Editor component of Firefox lets memory be reused after it is freed. The sources do not state what an attacker gets beyond this, so impact is unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the Firefox version with `about:support` or the Help menu; the sources say the bug was fixed in Firefox 160.

## Fix

- Firefox: move to `160` or later, per the sources.

## Timeline

- 2026-11-10T14:22:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124867

## From the sources

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_