---
id: "CVE-2026-124898"
page: "https://infrastack.ai/live/CVE-2026-124898"
kind: "vulnerability"
aliases: ["CVE-2026-124898"]
title: "Firefox: use-after-free in the DOM Editor component, fixed in 160"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "firefox", "runtime"]
not_affected_if: ["firefox-160-or-later"]
published_at: "2026-11-10T14:17:23+00:00"
first_seen_at: "2026-11-10T14:22:16+00:00"
updated_at: "2026-11-10T14:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124898", "first_seen_at": "2026-11-10T14:22:16+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in the DOM Editor component, fixed in 160

Link for people: https://infrastack.ai/live/CVE-2026-124898 (this .md is for agents)

A memory-safety bug (use-after-free) in Firefox's DOM Editor component lets freed memory be reused, which can crash the browser or be abused to run attacker code. The sources do not say how it is triggered or what an attacker can achieve beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line
- Compare against the fixed versions: `160`, `115.45` (ESR), `153.7` (ESR)

## Fix

- Firefox `160`
- Firefox ESR `115.45`
- Firefox ESR `153.7`

## Timeline

- 2026-11-10T14:22:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124898

## From the sources

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_