---
id: "CVE-2026-124870"
page: "https://infrastack.ai/live/CVE-2026-124870"
kind: "vulnerability"
aliases: ["CVE-2026-124870"]
title: "Firefox: JavaScript garbage collector boundary flaw, fixed in version 160"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "firefox", "runtime"]
not_affected_if: ["firefox-160-or-later", "firefox-esr-153.7-or-later"]
published_at: "2026-11-10T14:17:19+00:00"
first_seen_at: "2026-11-10T14:22:14+00:00"
updated_at: "2026-11-10T14:26:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124870", "first_seen_at": "2026-11-10T14:22:14+00:00"}]
exploit_sources: []
---

# Firefox: JavaScript garbage collector boundary flaw, fixed in version 160

Link for people: https://infrastack.ai/live/CVE-2026-124870 (this .md is for agents)

Firefox's JavaScript garbage collector has an incorrect boundary condition, which Mozilla fixed in Firefox 160 and Firefox ESR 153.7. The sources do not describe what an attacker can do with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the About Firefox dialog.
- Compare it with `160` for Firefox and `153.7` for Firefox ESR.

## Fix

- Firefox `160`
- Firefox ESR `153.7`

## Timeline

- 2026-11-10T14:22:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124870

## From the sources

Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_