---
id: "CVE-2026-124914"
page: "https://infrastack.ai/live/CVE-2026-124914"
kind: "vulnerability"
aliases: ["CVE-2026-124914"]
title: "Firefox: navigation flaw can break site isolation in the DOM"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "firefox", "runtime"]
not_affected_if: ["up-to-date-firefox"]
published_at: "2026-11-10T14:17:25+00:00"
first_seen_at: "2026-11-10T14:22:17+00:00"
updated_at: "2026-11-10T14:24:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124914", "first_seen_at": "2026-11-10T14:22:17+00:00"}]
exploit_sources: []
---

# Firefox: navigation flaw can break site isolation in the DOM

Link for people: https://infrastack.ai/live/CVE-2026-124914 (this .md is for agents)

A site isolation flaw in the DOM Navigation component of Firefox lets one website interfere with content from another site. The sources do not say what an attacker can read or change once the isolation is broken.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version (Help > About Firefox), which the sources do not give a command for.

## Fix

- Firefox: `160`
- Firefox ESR: `153.7`

## Timeline

- 2026-11-10T14:22:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124914

## From the sources

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_