CVE-2026-124893 · Runtime
NO FIX YET · SEE WHAT TO DO
A use-after-free bug in the DOM Workers component of Firefox lets memory be reused after it is freed. A successful attack could let a malicious web page crash the browser or possibly run code.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running a Firefox release older than 160 or Firefox ESR older than 153.7 is exposed, since the bug sits in the browser's Workers code that runs web page scripts. Systems that only run a patched release or a browser with the fix backported can skip it. The sources do not describe the exact trigger or exploit conditions.
Not affected if patched-version
Who cares browser, desktop, firefox
firefox --version on the command line160153.7Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.