{"id":"CVE-2026-124913","kind":"vulnerability","aliases":["CVE-2026-124913"],"related":[],"title":"Firefox: site isolation flaw in Networking component fixed in 160","description":"Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A site isolation issue in the Networking component of Firefox lets a malicious website reach data it should not see across site boundaries. The sources do not say what data an attacker can read or how easily it is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"how_to_check":"- Check the Firefox version with `about:support` in the address bar; versions below `160` on Firefox or `153.7` on Firefox ESR are affected.\n- Check whether ESR is in use via `about:support` (Application Basics shows the update channel).","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:37+00:00","updated_at":"2026-11-10T14:24:37+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:37Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: site isolation flaw in Networking component fixed in 160","impact":"medium","summary":"A site isolation issue in the Networking component of Firefox lets a malicious website reach data it should not see across site boundaries. The sources do not say what data an attacker can read or how easily it is triggered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"malicious site reads cross-site data inside the browser","analyst_note":"Confirm the exploit conditions and data exposed from the Mozilla security advisory for CVE-2026-124913, which the sources do not link.","how_to_check":"- Check the Firefox version with `about:support` in the address bar; versions below `160` on Firefox or `153.7` on Firefox ESR are affected.\n- Check whether ESR is in use via `about:support` (Application Basics shows the update channel).","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later through the browser's update settings.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is exposed when browsing sites, since the flaw sits in the browser's networking code. Systems on Firefox 160 or later, or Firefox ESR 153.7 or later, are not affected. The sources do not say whether specific configurations or extensions change exposure.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4466,"output_tokens":645,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124913':13A,16A '-2026':12A,15A '153.7':78C '160':10A,74C 'across':41B 'attack':52B 'boundari':43B 'browser':18B 'compon':7A,28B,67C 'cve':11A,14A 'data':36B,50B 'desktop':19B 'easili':57B 'esr':77C 'firefox':1A,17A,20B,30B,73C,76C 'fix':8A,71C 'flaw':4A 'isol':3A,23B,62C 'issu':24B,63C 'let':31B 'malici':33B 'network':6A,27B,66C 'reach':35B 'read':54B 'say':48B 'see':40B 'site':2A,22B,42B,61C 'sourc':45B 'trigger':60B 'vulner':69C 'websit':34B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions is exposed when browsing sites, since the flaw sits in the browser's networking code. Systems on Firefox 160 or later, or Firefox ESR 153.7 or later, are not affected. The sources do not say whether specific configurations or extensions change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later through the browser's update settings.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","desktop","firefox","other","unknown","vendor"],"campaign_type":null,"search_a":"'-124913':13A,16A '-2026':12A,15A '160':10A 'compon':7A 'cve':11A,14A 'firefox':1A,17A 'fix':8A 'flaw':4A 'isol':3A 'network':6A 'site':2A","search_b":"'across':41B 'attack':52B 'boundari':43B 'browser':18B 'compon':28B 'data':36B,50B 'desktop':19B 'easili':57B 'firefox':20B,30B 'isol':23B 'issu':24B 'let':31B 'malici':33B 'network':27B 'reach':35B 'read':54B 'say':48B 'see':40B 'site':22B,42B 'sourc':45B 'trigger':60B 'websit':34B","search_c":"'153.7':78C '160':74C 'compon':67C 'esr':77C 'firefox':73C,76C 'fix':71C 'isol':62C 'issu':63C 'network':66C 'site':61C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124913","severity":null,"published_at":"2026-11-10T14:17:25+00:00","modified_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}