---
id: "CVE-2026-124908"
page: "https://infrastack.ai/live/CVE-2026-124908"
kind: "vulnerability"
aliases: ["CVE-2026-124908"]
title: "Firefox: use-after-free in CSS parsing lets attackers run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "firefox", "runtime"]
not_affected_if: ["firefox-160-or-later"]
published_at: "2026-11-10T14:17:24+00:00"
first_seen_at: "2026-11-10T14:22:17+00:00"
updated_at: "2026-11-10T14:24:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124908", "first_seen_at": "2026-11-10T14:22:17+00:00"}]
exploit_sources: []
---

# Firefox: use-after-free in CSS parsing lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-124908 (this .md is for agents)

A use-after-free bug in Firefox's CSS parsing and computation component lets memory be reused after it is freed. The sources do not state what an attacker can do beyond that, so the impact is unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in Help > About Firefox.
- Versions earlier than `160` are the ones the sources say were fixed in `160`.

## Fix

- Firefox: move to `160` or later, as the sources state this was fixed in Firefox 160.

## Timeline

- 2026-11-10T14:22:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124908

## From the sources

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_