{"id":"CVE-2026-124881","kind":"vulnerability","aliases":["CVE-2026-124881"],"related":[],"title":"Firefox: use-after-free in CSS parsing lets attacker-crafted pages crash or run code","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's CSS parsing and computation code can be triggered by crafted web content. The sources do not say what an attacker can do beyond that, but memory corruption of this kind can lead to code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","package"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in the Help menu (About Firefox) or with the browser's version output.\n- Compare it with the fixed versions: Firefox `160`, Firefox ESR `115.45`, Firefox ESR `153.7`.","fix":"- Firefox: move to `160` or later.\n- Firefox ESR 115 branch: move to `115.45` or later.\n- Firefox ESR 153 branch: move to `153.7` or later.","status":"open","published_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","triaged_at":"2026-11-10T14:26:13+00:00","updated_at":"2026-11-10T14:26:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T14:26:13Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later.\n- Firefox ESR 115 branch: move to `115.45` or later.\n- Firefox ESR 153 branch: move to `153.7` or later.","reach":"internet","title":"Firefox: use-after-free in CSS parsing lets attacker-crafted pages crash or run code","impact":"high","summary":"A use-after-free bug in Firefox's CSS parsing and computation code can be triggered by crafted web content. The sources do not say what an attacker can do beyond that, but memory corruption of this kind can lead to code execution.","audience":"everyone","category":"package","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Browser crashes or attacker-controlled code runs in the browser","analyst_note":"","how_to_check":"- Check the installed Firefox version in the Help menu (About Firefox) or with the browser's version output.\n- Compare it with the fixed versions: Firefox `160`, Firefox ESR `115.45`, Firefox ESR `153.7`.","plain_action":"Update Firefox to version 160, or the ESR version 115.45 or 153.7 if you use an ESR release.","product_name":"","needs_analyst":false,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. Browsing untrusted pages is the path in; the sources do not describe any server-side exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4492,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124881':20A,23A '-2026':19A,22A '115.45':92C '153.7':96C '160':89C 'attack':11A,56B 'attacker-craft':10A 'beyond':59B 'browser':24B 'bug':33B 'code':17A,41B,70B 'compon':82C 'comput':40B,81C 'content':48B 'corrupt':63B 'craft':12A,46B 'crash':14A 'css':7A,37B,78C 'cve':18A,21A 'desktop':25B 'esr':91C,95C 'execut':71B 'firefox':1A,26B,35B,88C,90C,94C 'fix':86C 'free':5A,32B,75C 'kind':66B 'lead':68B 'let':9A 'memori':62B 'packag':27B 'page':13A 'pars':8A,38B,79C 'run':16A 'say':53B 'sourc':50B 'trigger':44B 'use':3A,30B,73C 'use-after-fre':2A,29B,72C 'vulner':84C 'web':47B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. Browsing untrusted pages is the path in; the sources do not describe any server-side exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160, or the ESR version 115.45 or 153.7 if you use an ESR release.","pkeys":[],"ptokens":[],"labels":["browser","desktop","firefox","package","unknown"],"campaign_type":null,"search_a":"'-124881':20A,23A '-2026':19A,22A 'attack':11A 'attacker-craft':10A 'code':17A 'craft':12A 'crash':14A 'css':7A 'cve':18A,21A 'firefox':1A 'free':5A 'let':9A 'page':13A 'pars':8A 'run':16A 'use':3A 'use-after-fre':2A","search_b":"'attack':56B 'beyond':59B 'browser':24B 'bug':33B 'code':41B,70B 'comput':40B 'content':48B 'corrupt':63B 'craft':46B 'css':37B 'desktop':25B 'execut':71B 'firefox':26B,35B 'free':32B 'kind':66B 'lead':68B 'memori':62B 'packag':27B 'pars':38B 'say':53B 'sourc':50B 'trigger':44B 'use':30B 'use-after-fre':29B 'web':47B","search_c":"'115.45':92C '153.7':96C '160':89C 'compon':82C 'comput':81C 'css':78C 'esr':91C,95C 'firefox':88C,90C,94C 'fix':86C 'free':75C 'pars':79C 'use':73C 'use-after-fre':72C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124881","severity":null,"published_at":"2026-11-10T14:17:21+00:00","modified_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","fetched_at":"2026-11-10T14:22:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}