{"id":"CVE-2026-124890","kind":"vulnerability","aliases":["CVE-2026-124890"],"related":[],"title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox lets memory be used after it is freed. The description does not say what an attacker gets at worst, and the sources give no severity.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`.\n- Flag any install below `160`, `115.45` (ESR 115) or `153.7` (ESR 153) as exposed.","fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","status":"open","published_at":"2026-11-10T14:17:22+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","triaged_at":"2026-11-10T14:26:04+00:00","updated_at":"2026-11-10T14:26:04+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:26:04Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160`\n- Firefox ESR `115.45`\n- Firefox ESR `153.7`","reach":"internet","title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","impact":"high","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox lets memory be used after it is freed. The description does not say what an attacker gets at worst, and the sources give no severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown: sources do not say what an attacker gets","analyst_note":"Confirm the NVD entry and Mozilla's advisory for CVSS, exploitability and whether user interaction is needed.","how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`.\n- Flag any install below `160`, `115.45` (ESR 115) or `153.7` (ESR 153) as exposed.","plain_action":"Update Firefox to version 160 or later, or to the ESR release 115.45 or 153.7, through the browser's update menu.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions named in the description. The sources do not say whether the flaw is reachable without user action, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4490,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124890':17A,20A '-2026':16A,19A '115.45':85C '153.7':89C '160':82C 'attack':12A,56B 'browser':22B 'bug':31B 'code':14A 'compon':38B,75C 'core':8A,35B,73C 'cve':15A,18A 'descript':50B 'desktop':23B 'dom':7A,34B,72C 'esr':84C,88C 'firefox':1A,21A,24B,40B,81C,83C,87C 'fix':79C 'free':5A,30B,69C 'freed':48B 'get':57B 'give':63B 'html':10A,37B,74C 'let':11A,41B 'memori':42B 'run':13A 'runtim':25B 'say':53B 'sever':65B 'sourc':62B 'use':3A,28B,44B,67C 'use-after-fre':2A,27B,66C 'vulner':77C 'worst':59B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions named in the description. The sources do not say whether the flaw is reachable without user action, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later, or to the ESR release 115.45 or 153.7, through the browser's update menu.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","desktop","firefox","runtime","unknown","vendor"],"campaign_type":null,"search_a":"'-124890':17A,20A '-2026':16A,19A 'attack':12A 'code':14A 'core':8A 'cve':15A,18A 'dom':7A 'firefox':1A,21A 'free':5A 'html':10A 'let':11A 'run':13A 'use':3A 'use-after-fre':2A","search_b":"'attack':56B 'browser':22B 'bug':31B 'compon':38B 'core':35B 'descript':50B 'desktop':23B 'dom':34B 'firefox':24B,40B 'free':30B 'freed':48B 'get':57B 'give':63B 'html':37B 'let':41B 'memori':42B 'runtim':25B 'say':53B 'sever':65B 'sourc':62B 'use':28B,44B 'use-after-fre':27B 'worst':59B","search_c":"'115.45':85C '153.7':89C '160':82C 'compon':75C 'core':73C 'dom':72C 'esr':84C,88C 'firefox':81C,83C,87C 'fix':79C 'free':69C 'html':74C 'use':67C 'use-after-fre':66C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124890","severity":null,"published_at":"2026-11-10T14:17:22+00:00","modified_at":"2026-11-10T14:17:22+00:00","first_seen_at":"2026-11-10T14:22:15+00:00","fetched_at":"2026-11-10T14:22:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}