---
id: "CVE-2026-124881"
page: "https://infrastack.ai/live/CVE-2026-124881"
kind: "vulnerability"
aliases: ["CVE-2026-124881"]
title: "Firefox: use-after-free in CSS parsing lets attacker-crafted pages crash or run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browser", "desktop", "firefox", "package"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-11-10T14:17:21+00:00"
first_seen_at: "2026-11-10T14:22:15+00:00"
updated_at: "2026-11-10T14:26:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124881", "first_seen_at": "2026-11-10T14:22:15+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in CSS parsing lets attacker-crafted pages crash or run code

Link for people: https://infrastack.ai/live/CVE-2026-124881 (this .md is for agents)

A use-after-free bug in Firefox's CSS parsing and computation code can be triggered by crafted web content. The sources do not say what an attacker can do beyond that, but memory corruption of this kind can lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the Help menu (About Firefox) or with the browser's version output.
- Compare it with the fixed versions: Firefox `160`, Firefox ESR `115.45`, Firefox ESR `153.7`.

## Fix

- Firefox: move to `160` or later.
- Firefox ESR 115 branch: move to `115.45` or later.
- Firefox ESR 153 branch: move to `153.7` or later.

## Timeline

- 2026-11-10T14:22:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124881

## From the sources

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_