{"id":"CVE-2026-124869","kind":"vulnerability","aliases":["CVE-2026-124869"],"related":[],"title":"Firefox: use-after-free in DOM core and HTML component","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","firefox","other"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the Firefox version with Help > About Firefox\n- Compare against the fixed versions: Firefox `160` and Firefox ESR `153.7`","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:19+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","triaged_at":"2026-11-10T14:26:26+00:00","updated_at":"2026-11-10T14:26:26+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:26:26Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: use-after-free in DOM core and HTML component","impact":"medium","summary":"A use-after-free bug in Firefox's DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can gain from it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for CVE-2026-124869 to confirm impact, trigger conditions and whether it is exploited.","how_to_check":"- Check the Firefox version with Help > About Firefox\n- Compare against the fixed versions: Firefox `160` and Firefox ESR `153.7`","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 from the Firefox menu's About Firefox page.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Firefox installs older than the fixed versions are affected. The sources do not say whether specific configurations or content are needed to trigger it. Users on fixed versions can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4478,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124869':14A,17A '-2026':13A,16A '153.7':73C '160':69C 'attack':50B 'browser':19B 'bug':26B 'compon':11A,34B,62C 'core':8A,31B,60C 'cve':12A,15A 'dom':7A,30B,59C 'esr':72C 'firefox':1A,18A,20B,28B,68C,71C 'fix':66C 'free':5A,25B,56C 'freed':42B 'gain':52B 'html':10A,33B,61C 'let':35B 'memori':36B 'reus':38B 'say':47B 'sourc':44B 'use':3A,23B,54C 'use-after-fre':2A,22B,53C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Firefox installs older than the fixed versions are affected. The sources do not say whether specific configurations or content are needed to trigger it. Users on fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 from the Firefox menu's About Firefox page.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","firefox","other","unknown","vendor"],"campaign_type":null,"search_a":"'-124869':14A,17A '-2026':13A,16A 'compon':11A 'core':8A 'cve':12A,15A 'dom':7A 'firefox':1A,18A 'free':5A 'html':10A 'use':3A 'use-after-fre':2A","search_b":"'attack':50B 'browser':19B 'bug':26B 'compon':34B 'core':31B 'dom':30B 'firefox':20B,28B 'free':25B 'freed':42B 'gain':52B 'html':33B 'let':35B 'memori':36B 'reus':38B 'say':47B 'sourc':44B 'use':23B 'use-after-fre':22B","search_c":"'153.7':73C '160':69C 'compon':62C 'core':60C 'dom':59C 'esr':72C 'firefox':68C,71C 'fix':66C 'free':56C 'html':61C 'use':54C 'use-after-fre':53C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124869","severity":null,"published_at":"2026-11-10T14:17:19+00:00","modified_at":"2026-11-10T14:17:19+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","fetched_at":"2026-11-10T14:22:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}