---
id: "CVE-2026-124890"
page: "https://infrastack.ai/live/CVE-2026-124890"
kind: "vulnerability"
aliases: ["CVE-2026-124890"]
title: "Firefox: use-after-free in DOM core and HTML lets attackers run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "desktop", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-11-10T14:17:22+00:00"
first_seen_at: "2026-11-10T14:22:15+00:00"
updated_at: "2026-11-10T14:26:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124890", "first_seen_at": "2026-11-10T14:22:15+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in DOM core and HTML lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-124890 (this .md is for agents)

A use-after-free bug in the DOM Core and HTML component of Firefox lets memory be used after it is freed. The description does not say what an attacker gets at worst, and the sources give no severity.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the Firefox version in the browser's About page or with `firefox --version`.
- Flag any install below `160`, `115.45` (ESR 115) or `153.7` (ESR 153) as exposed.

## Fix

- Firefox `160`
- Firefox ESR `115.45`
- Firefox ESR `153.7`

## Timeline

- 2026-11-10T14:22:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124890

## From the sources

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_