{"id":"CVE-2026-124882","kind":"vulnerability","aliases":["CVE-2026-124882"],"related":[],"title":"Firefox: use-after-free in CSS parsing lets attackers run code","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's CSS parsing and computation component can corrupt memory when a page is processed. Attackers may be able to use it to run code in the browser, but the sources do not say how it is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["updated-firefox"],"how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.\n- Flag installs older than `160`, `115.45` for the ESR 115 branch, or `153.7` for the ESR 153 branch.","fix":"- Firefox: `160`\n- Firefox ESR 115: `115.45`\n- Firefox ESR 153: `153.7`","status":"open","published_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","triaged_at":"2026-11-10T14:26:12+00:00","updated_at":"2026-11-10T14:26:12+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:26:12Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR 115: `115.45`\n- Firefox ESR 153: `153.7`","reach":"internet","title":"Firefox: use-after-free in CSS parsing lets attackers run code","impact":"high","summary":"A use-after-free bug in Firefox's CSS parsing and computation component can corrupt memory when a page is processed. Attackers may be able to use it to run code in the browser, but the sources do not say how it is triggered.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker may run code inside the browser process.","analyst_note":"Confirm trigger conditions and whether exploitation is possible via a web page, from the Mozilla security advisory for CVE-2026-124882.","how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.\n- Flag installs older than `160`, `115.45` for the ESR 115 branch, or `153.7` for the ESR 153 branch.","plain_action":"Update Firefox to version 160 or later (or the matching ESR release), using Firefox's own update check under Help > About Firefox.","product_name":"","needs_analyst":true,"not_affected_if":["updated-firefox"],"who_is_affected":"Anyone running an unpatched Firefox release, including the standard and ESR branches named in the advisory. Systems that ship Firefox from an OS package manager depend on that distributor's update. The sources do not say whether the flaw needs a particular page or setting to trigger.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000764,"input_tokens":4492,"output_tokens":629,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124882':15A,18A '-2026':14A,17A '115.45':88C '153.7':92C '160':85C 'abl':48B 'attack':10A,45B 'browser':19B,57B 'bug':28B 'code':12A,54B 'compon':36B,78C 'comput':35B,77C 'corrupt':38B 'css':7A,32B,74C 'cve':13A,16A 'desktop':20B 'esr':87C,91C 'firefox':1A,21B,30B,84C,86C,90C 'fix':82C 'free':5A,27B,71C 'let':9A 'may':46B 'memori':39B 'page':42B 'pars':8A,33B,75C 'process':44B 'run':11A,53B 'runtim':22B 'say':63B 'sourc':60B 'trigger':67B 'use':3A,25B,50B,69C 'use-after-fre':2A,24B,68C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running an unpatched Firefox release, including the standard and ESR branches named in the advisory. Systems that ship Firefox from an OS package manager depend on that distributor's update. The sources do not say whether the flaw needs a particular page or setting to trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later (or the matching ESR release), using Firefox's own update check under Help > About Firefox.","pkeys":[],"ptokens":[],"labels":["browsers","desktop","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124882':15A,18A '-2026':14A,17A 'attack':10A 'code':12A 'css':7A 'cve':13A,16A 'firefox':1A 'free':5A 'let':9A 'pars':8A 'run':11A 'use':3A 'use-after-fre':2A","search_b":"'abl':48B 'attack':45B 'browser':19B,57B 'bug':28B 'code':54B 'compon':36B 'comput':35B 'corrupt':38B 'css':32B 'desktop':20B 'firefox':21B,30B 'free':27B 'may':46B 'memori':39B 'page':42B 'pars':33B 'process':44B 'run':53B 'runtim':22B 'say':63B 'sourc':60B 'trigger':67B 'use':25B,50B 'use-after-fre':24B","search_c":"'115.45':88C '153.7':92C '160':85C 'compon':78C 'comput':77C 'css':74C 'esr':87C,91C 'firefox':84C,86C,90C 'fix':82C 'free':71C 'pars':75C 'use':69C 'use-after-fre':68C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124882","severity":null,"published_at":"2026-11-10T14:17:21+00:00","modified_at":"2026-11-10T14:17:21+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","fetched_at":"2026-11-10T14:22:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}