{"id":"CVE-2026-124907","kind":"vulnerability","aliases":["CVE-2026-124907"],"related":[],"title":"Firefox: use-after-free in WebGL canvas lets sandboxed code escape","description":"Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's WebGL canvas graphics component allows privilege escalation and escape from the browser sandbox. Fixed in Firefox 160 and Firefox ESR 153.7.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"how_to_check":"- Check the installed Firefox version in Firefox's About dialog (Help > About Firefox).\n- Compare against `160` for Firefox and `153.7` for Firefox ESR.","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:44+00:00","updated_at":"2026-11-10T14:24:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T14:24:44Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: use-after-free in WebGL canvas lets sandboxed code escape","impact":"high","summary":"A use-after-free bug in Firefox's WebGL canvas graphics component allows privilege escalation and escape from the browser sandbox. Fixed in Firefox 160 and Firefox ESR 153.7.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker escapes the browser sandbox and runs code on the device","analyst_note":"","how_to_check":"- Check the installed Firefox version in Firefox's About dialog (Help > About Firefox).\n- Compare against `160` for Firefox and `153.7` for Firefox ESR.","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 (Help > About Firefox).","product_name":"","needs_analyst":false,"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"who_is_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. Organizations running Firefox ESR on managed desktops are affected through the desktop fleet. Systems without Firefox installed are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4514,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124907':15A,18A '-2026':14A,17A '153.7':51B,77C '160':47B,73C 'allow':35B 'browser':19B,42B 'bug':27B 'canva':8A,32B 'canvaswebgl':65C 'code':11A 'compon':34B,66C 'cve':13A,16A 'desktop':20B 'due':56C 'escal':37B,53C 'escap':12A,39B,55C 'esr':50B,76C 'firefox':1A,21B,29B,46B,49B,72C,75C 'fix':44B,70C 'free':5A,26B,61C 'graphic':33B,64C 'let':9A 'privileg':36B,52C 'sandbox':10A,43B,54C 'use':3A,24B,59C 'use-after-fre':2A,23B,58C 'vulner':68C 'webgl':7A,31B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. Organizations running Firefox ESR on managed desktops are affected through the desktop fleet. Systems without Firefox installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 (Help > About Firefox).","pkeys":[],"ptokens":[],"labels":["browser","desktop","firefox","high","other"],"campaign_type":null,"search_a":"'-124907':15A,18A '-2026':14A,17A 'canva':8A 'code':11A 'cve':13A,16A 'escap':12A 'firefox':1A 'free':5A 'let':9A 'sandbox':10A 'use':3A 'use-after-fre':2A 'webgl':7A","search_b":"'153.7':51B '160':47B 'allow':35B 'browser':19B,42B 'bug':27B 'canva':32B 'compon':34B 'desktop':20B 'escal':37B 'escap':39B 'esr':50B 'firefox':21B,29B,46B,49B 'fix':44B 'free':26B 'graphic':33B 'privileg':36B 'sandbox':43B 'use':24B 'use-after-fre':23B 'webgl':31B","search_c":"'153.7':77C '160':73C 'canvaswebgl':65C 'compon':66C 'due':56C 'escal':53C 'escap':55C 'esr':76C 'firefox':72C,75C 'fix':70C 'free':61C 'graphic':64C 'privileg':52C 'sandbox':54C 'use':59C 'use-after-fre':58C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124907","severity":null,"published_at":"2026-11-10T14:17:24+00:00","modified_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}