{"id":"CVE-2026-124893","kind":"vulnerability","aliases":["CVE-2026-124893"],"related":[],"title":"Firefox: use-after-free in Workers code may let attackers run code","description":"Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in the DOM Workers component of Firefox lets memory be reused after it is freed. A successful attack could let a malicious web page crash the browser or possibly run code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["patched-version"],"how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line\n- Compare it against the fixed releases: Firefox 160 and Firefox ESR 153.7","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:22+00:00","first_seen_at":"2026-11-10T14:22:16+00:00","triaged_at":"2026-11-10T14:25:59+00:00","updated_at":"2026-11-10T14:25:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T14:25:59Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: use-after-free in Workers code may let attackers run code","impact":"high","summary":"A use-after-free bug in the DOM Workers component of Firefox lets memory be reused after it is freed. A successful attack could let a malicious web page crash the browser or possibly run code.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"malicious web page could crash browser or run code","analyst_note":"Check the Mozilla security advisory for CVE-2026-124893 to confirm exploit conditions and whether the bug is exploitable beyond a crash.","how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line\n- Compare it against the fixed releases: Firefox 160 and Firefox ESR 153.7","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later: Help > About Firefox.","product_name":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Anyone running a Firefox release older than 160 or Firefox ESR older than 153.7 is exposed, since the bug sits in the browser's Workers code that runs web page scripts. Systems that only run a patched release or a browser with the fix backported can skip it. The sources do not describe the exact trigger or exploit conditions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4472,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124893':16A,19A '-2026':15A,18A '153.7':80C '160':76C 'attack':11A,47B 'browser':20B,56B 'bug':29B 'code':8A,13A,60B 'compon':34B,69C 'could':48B 'crash':54B 'cve':14A,17A 'desktop':21B 'dom':32B,67C 'esr':79C 'firefox':1A,22B,36B,75C,78C 'fix':73C 'free':5A,28B,64C 'freed':44B 'let':10A,37B,49B 'malici':51B 'may':9A 'memori':38B 'page':53B 'possibl':58B 'reus':40B 'run':12A,59B 'runtim':23B 'success':46B 'use':3A,26B,62C 'use-after-fre':2A,25B,61C 'vulner':71C 'web':52B 'worker':7A,33B,68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox release older than 160 or Firefox ESR older than 153.7 is exposed, since the bug sits in the browser's Workers code that runs web page scripts. Systems that only run a patched release or a browser with the fix backported can skip it. The sources do not describe the exact trigger or exploit conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later: Help > About Firefox.","pkeys":[],"ptokens":[],"labels":["browser","desktop","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124893':16A,19A '-2026':15A,18A 'attack':11A 'code':8A,13A 'cve':14A,17A 'firefox':1A 'free':5A 'let':10A 'may':9A 'run':12A 'use':3A 'use-after-fre':2A 'worker':7A","search_b":"'attack':47B 'browser':20B,56B 'bug':29B 'code':60B 'compon':34B 'could':48B 'crash':54B 'desktop':21B 'dom':32B 'firefox':22B,36B 'free':28B 'freed':44B 'let':37B,49B 'malici':51B 'memori':38B 'page':53B 'possibl':58B 'reus':40B 'run':59B 'runtim':23B 'success':46B 'use':26B 'use-after-fre':25B 'web':52B 'worker':33B","search_c":"'153.7':80C '160':76C 'compon':69C 'dom':67C 'esr':79C 'firefox':75C,78C 'fix':73C 'free':64C 'use':62C 'use-after-fre':61C 'vulner':71C 'worker':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124893","severity":null,"published_at":"2026-11-10T14:17:22+00:00","modified_at":"2026-11-10T14:17:22+00:00","first_seen_at":"2026-11-10T14:22:16+00:00","fetched_at":"2026-11-10T14:22:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}