{"id":"CVE-2026-124917","kind":"vulnerability","aliases":["CVE-2026-124917"],"related":[],"title":"Firefox: use-after-free in GTK widget lets attackers escape the sandbox","description":"Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's GTK widget component allows a sandbox escape. An attacker who can get content running in the browser could use it to break out of the browser's sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firefox","firefox-esr","gtk","linux","runtime"],"not_affected_if":["already-updated","non-gtk-platform"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`, and compare it with the fixed versions below.\n- Check whether Firefox ESR is in use and its version.","fix":"- Firefox: move to `160` or later.\n- Firefox ESR: move to `153.7` or later.","status":"open","published_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:33+00:00","updated_at":"2026-11-10T14:24:33+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T14:24:33Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later.\n- Firefox ESR: move to `153.7` or later.","reach":"internet","title":"Firefox: use-after-free in GTK widget lets attackers escape the sandbox","impact":"high","summary":"A use-after-free bug in Firefox's GTK widget component allows a sandbox escape. An attacker who can get content running in the browser could use it to break out of the browser's sandbox.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","linux","gtk"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"malicious web content escapes the browser sandbox to the system","analyst_note":"Confirm the affected platforms and whether exploitation requires a specific GTK configuration, using the Mozilla security advisory for this CVE.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`, and compare it with the fixed versions below.\n- Check whether Firefox ESR is in use and its version.","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: Menu > Settings > General > Firefox Updates.","product_name":"","needs_analyst":true,"not_affected_if":["already-updated","non-gtk-platform"],"who_is_affected":"Anyone running Firefox or Firefox ESR on Linux or other systems using the GTK widget component before the fixed versions. Exposure comes from browsing untrusted web content. Systems on managed Firefox builds should follow their own update channel.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4490,"output_tokens":606,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124917':16A,19A '-2026':15A,18A '153.7':87C '160':83C 'allow':39B 'attack':10A,44B 'break':57B 'browser':52B,61B 'bug':32B 'compon':38B,76C 'content':48B 'could':53B 'cve':14A,17A 'due':66C 'escap':11A,42B,65C 'esr':23B,86C 'firefox':1A,20B,22B,34B,82C,85C 'firefox-esr':21B 'fix':80C 'free':5A,31B,71C 'get':47B 'gtk':7A,24B,36B,75C 'let':9A 'linux':25B 'run':49B 'runtim':26B 'sandbox':13A,41B,63B,64C 'use':3A,29B,54B,69C 'use-after-fre':2A,28B,68C 'vulner':78C 'widget':8A,37B,74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR on Linux or other systems using the GTK widget component before the fixed versions. Exposure comes from browsing untrusted web content. Systems on managed Firefox builds should follow their own update channel.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: Menu > Settings > General > Firefox Updates.","pkeys":[],"ptokens":[],"labels":["firefox","firefoxesr","gtk","high","linux","runtime"],"campaign_type":null,"search_a":"'-124917':16A,19A '-2026':15A,18A 'attack':10A 'cve':14A,17A 'escap':11A 'firefox':1A 'free':5A 'gtk':7A 'let':9A 'sandbox':13A 'use':3A 'use-after-fre':2A 'widget':8A","search_b":"'allow':39B 'attack':44B 'break':57B 'browser':52B,61B 'bug':32B 'compon':38B 'content':48B 'could':53B 'escap':42B 'esr':23B 'firefox':20B,22B,34B 'firefox-esr':21B 'free':31B 'get':47B 'gtk':24B,36B 'linux':25B 'run':49B 'runtim':26B 'sandbox':41B,63B 'use':29B,54B 'use-after-fre':28B 'widget':37B","search_c":"'153.7':87C '160':83C 'compon':76C 'due':66C 'escap':65C 'esr':86C 'firefox':82C,85C 'fix':80C 'free':71C 'gtk':75C 'sandbox':64C 'use':69C 'use-after-fre':68C 'vulner':78C 'widget':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124917","severity":null,"published_at":"2026-11-10T14:17:25+00:00","modified_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}