{"id":"CVE-2026-124909","kind":"vulnerability","aliases":["CVE-2026-124909"],"related":[],"title":"Firefox: Private Browsing flaw leaks information to local observers","description":"Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A flaw in the Private Browsing component of Firefox discloses information that should stay hidden. The sources do not say what data leaks or what an attacker must do to read it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["already-updated-firefox"],"how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on the command line.\n- Compare against the fixed versions: Firefox `160` and Firefox ESR `153.7`.","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:41+00:00","updated_at":"2026-11-10T14:24:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:41Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"unknown","title":"Firefox: Private Browsing flaw leaks information to local observers","impact":"low","summary":"A flaw in the Private Browsing component of Firefox discloses information that should stay hidden. The sources do not say what data leaks or what an attacker must do to read it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown information from Private Browsing is exposed to an attacker","analyst_note":"","how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on the command line.\n- Compare against the fixed versions: Firefox `160` and Firefox ESR `153.7`.","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7: Menu > Help > About Firefox.","product_name":"","needs_analyst":false,"not_affected_if":["already-updated-firefox"],"who_is_affected":"Anyone running a Firefox release before 160 or a Firefox ESR release before 153.7 is exposed. The sources do not say what data is disclosed or whether any special setting or user action is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000694,"input_tokens":4470,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124909':12A,15A '-2026':11A,14A '153.7':68C '160':64C 'attack':46B 'brows':3A,25B,56C 'browser':18B 'compon':26B,57C 'cve':10A,13A 'data':41B 'desktop':17B 'desktop-brows':16B 'disclos':29B 'disclosur':52C 'esr':67C 'firefox':1A,19B,28B,63C,66C 'fix':61C 'flaw':4A,21B 'hidden':34B 'inform':6A,30B,51C 'leak':5A,42B 'local':8A 'must':47B 'observ':9A 'privat':2A,24B,55C 'read':50B 'say':39B 'sourc':36B 'stay':33B 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox release before 160 or a Firefox ESR release before 153.7 is exposed. The sources do not say what data is disclosed or whether any special setting or user action is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7: Menu > Help > About Firefox.","pkeys":[],"ptokens":[],"labels":["desktopbrowsers","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124909':12A,15A '-2026':11A,14A 'brows':3A 'cve':10A,13A 'firefox':1A 'flaw':4A 'inform':6A 'leak':5A 'local':8A 'observ':9A 'privat':2A","search_b":"'attack':46B 'brows':25B 'browser':18B 'compon':26B 'data':41B 'desktop':17B 'desktop-brows':16B 'disclos':29B 'firefox':19B,28B 'flaw':21B 'hidden':34B 'inform':30B 'leak':42B 'must':47B 'privat':24B 'read':50B 'say':39B 'sourc':36B 'stay':33B","search_c":"'153.7':68C '160':64C 'brows':56C 'compon':57C 'disclosur':52C 'esr':67C 'firefox':63C,66C 'fix':61C 'inform':51C 'privat':55C 'vulner':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124909","severity":null,"published_at":"2026-11-10T14:17:24+00:00","modified_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}