---
id: "CVE-2026-124909"
page: "https://infrastack.ai/live/CVE-2026-124909"
kind: "vulnerability"
aliases: ["CVE-2026-124909"]
title: "Firefox: Private Browsing flaw leaks information to local observers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop-browsers", "firefox", "other"]
not_affected_if: ["already-updated-firefox"]
published_at: "2026-11-10T14:17:24+00:00"
first_seen_at: "2026-11-10T14:22:17+00:00"
updated_at: "2026-11-10T14:24:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124909", "first_seen_at": "2026-11-10T14:22:17+00:00"}]
exploit_sources: []
---

# Firefox: Private Browsing flaw leaks information to local observers

Link for people: https://infrastack.ai/live/CVE-2026-124909 (this .md is for agents)

A flaw in the Private Browsing component of Firefox discloses information that should stay hidden. The sources do not say what data leaks or what an attacker must do to read it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on the command line.
- Compare against the fixed versions: Firefox `160` and Firefox ESR `153.7`.

## Fix

- Firefox: `160`
- Firefox ESR: `153.7`

## Timeline

- 2026-11-10T14:22:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124909

## From the sources

Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_