{"id":"CVE-2026-124901","kind":"vulnerability","aliases":["CVE-2026-124901"],"related":[],"title":"Firefox: networking JAR component flaw fixed in recent releases","description":"Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A flaw in the Networking: JAR component of Firefox was fixed in Firefox 160, Firefox ESR 115.45 and Firefox ESR 153.7. The sources do not describe what an attacker can do with it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["browser","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare it against `160`, `115.45` (ESR) and `153.7` (ESR)","fix":"- Firefox: `160`\n- Firefox ESR: `115.45` and `153.7`","status":"open","published_at":"2026-11-10T14:17:23+00:00","first_seen_at":"2026-11-10T14:22:16+00:00","triaged_at":"2026-11-10T14:24:51+00:00","updated_at":"2026-11-10T14:24:51+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T14:24:51Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `115.45` and `153.7`","reach":"unknown","title":"Firefox: networking JAR component flaw fixed in recent releases","impact":"medium","summary":"A flaw in the Networking: JAR component of Firefox was fixed in Firefox 160, Firefox ESR 115.45 and Firefox ESR 153.7. The sources do not describe what an attacker can do with it.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown from the sources; the flaw is in browser networking code","analyst_note":"Find the Mozilla security advisory for this CVE to learn the trigger, impact and whether it is exploitable from a web page.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare it against `160`, `115.45` (ESR) and `153.7` (ESR)\n- unknown for anything beyond the version","plain_action":"Update Firefox to version 160 or the ESR release 115.45 or 153.7 by restarting it after the update.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox older than the fixed versions is in scope, since the flaw sits in the browser's networking code. The sources do not say what input triggers it or whether a web page alone is enough. Users already on the fixed versions are not affected.","user_interaction":"unknown","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4480,"output_tokens":606,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124901':12A,15A '-2026':11A,14A '115.45':36B,65C '153.7':40B,69C '160':33B,62C 'attack':48B 'browser':17B 'compon':4A,26B,55C 'cve':10A,13A 'describ':45B 'esr':35B,39B,64C,68C 'firefox':1A,16A,18B,28B,32B,34B,38B,61C,63C,67C 'fix':6A,30B,59C 'flaw':5A,21B 'issu':50C 'jar':3A,25B,54C 'network':2A,24B,53C 'recent':8A 'releas':9A 'runtim':19B 'sourc':42B 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than the fixed versions is in scope, since the flaw sits in the browser's networking code. The sources do not say what input triggers it or whether a web page alone is enough. Users already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or the ESR release 115.45 or 153.7 by restarting it after the update.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124901':12A,15A '-2026':11A,14A 'compon':4A 'cve':10A,13A 'firefox':1A,16A 'fix':6A 'flaw':5A 'jar':3A 'network':2A 'recent':8A 'releas':9A","search_b":"'115.45':36B '153.7':40B '160':33B 'attack':48B 'browser':17B 'compon':26B 'describ':45B 'esr':35B,39B 'firefox':18B,28B,32B,34B,38B 'fix':30B 'flaw':21B 'jar':25B 'network':24B 'runtim':19B 'sourc':42B","search_c":"'115.45':65C '153.7':69C '160':62C 'compon':55C 'esr':64C,68C 'firefox':61C,63C,67C 'fix':59C 'issu':50C 'jar':54C 'network':53C 'vulner':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124901","severity":null,"published_at":"2026-11-10T14:17:23+00:00","modified_at":"2026-11-10T14:17:23+00:00","first_seen_at":"2026-11-10T14:22:16+00:00","fetched_at":"2026-11-10T14:22:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}