---
id: "CVE-2026-124895"
page: "https://infrastack.ai/live/CVE-2026-124895"
kind: "vulnerability"
aliases: ["CVE-2026-124895"]
title: "Firefox: use-after-free in localStorage and sessionStorage can crash or run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["patched-firefox"]
published_at: "2026-11-10T14:17:23+00:00"
first_seen_at: "2026-11-10T14:22:16+00:00"
updated_at: "2026-11-10T14:24:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124895", "first_seen_at": "2026-11-10T14:22:16+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in localStorage and sessionStorage can crash or run code

Link for people: https://infrastack.ai/live/CVE-2026-124895 (this .md is for agents)

Firefox has a use-after-free bug in its localStorage and sessionStorage component, which handles data web pages store in the browser. The sources do not state what an attacker gets beyond the memory corruption itself.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.
- Compare it against the fixed versions: Firefox `160`, Firefox ESR `115.45`, and Firefox ESR `153.7`.

## Fix

- Firefox `160`
- Firefox ESR `115.45`
- Firefox ESR `153.7`

## Timeline

- 2026-11-10T14:22:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124895

## From the sources

Use-after-free in the Storage: localStorage & sessionStorage component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_