{"id":"CVE-2026-124919","kind":"vulnerability","aliases":["CVE-2026-124919"],"related":[],"title":"Firefox: WebRTC networking use-after-free allows privilege escalation","description":"Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A use-after-free bug in Firefox's WebRTC networking component lets malicious code cause memory to be reused unsafely. An attacker can use this to escalate privileges inside the browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","firefox-esr","runtime","webrtc"],"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on Linux.\n- Check that the installed version is below `160` for Firefox or below `153.7` for Firefox ESR.","fix":"- Firefox: move to `160` or later.\n- Firefox ESR: move to `153.7` or later.","status":"open","published_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:31+00:00","updated_at":"2026-11-10T14:24:31+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:24:31Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later.\n- Firefox ESR: move to `153.7` or later.","reach":"internet","title":"Firefox: WebRTC networking use-after-free allows privilege escalation","impact":"high","summary":"A use-after-free bug in Firefox's WebRTC networking component lets malicious code cause memory to be reused unsafely. An attacker can use this to escalate privileges inside the browser.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","browsers","webrtc"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker escalates privileges inside the browser process","analyst_note":"Confirm the exploit trigger conditions and whether WebRTC must be active, using the Mozilla security advisory linked from NVD.","how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on Linux.\n- Check that the installed version is below `160` for Firefox or below `153.7` for Firefox ESR.","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: Help > About Firefox.","product_name":"","needs_analyst":true,"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"who_is_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. The bug sits in WebRTC networking, so exposure is highest where calls or media features are used, but the sources do not say whether WebRTC must be actively in use. Managed desktops should be checked against their Firefox ESR pin.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4492,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124919':13A,16A '-2026':12A,15A '153.7':79C '160':75C 'allow':8A 'attack':46B 'browser':17B,55B 'bug':29B 'caus':39B 'code':38B 'compon':35B,68C 'cve':11A,14A 'due':58C 'escal':10A,51B,57C 'esr':21B,78C 'firefox':1A,18B,20B,31B,74C,77C 'firefox-esr':19B 'fix':72C 'free':7A,28B,63C 'insid':53B 'let':36B 'malici':37B 'memori':40B 'network':3A,34B,67C 'privileg':9A,52B,56C 'reus':43B 'runtim':22B 'unsaf':44B 'use':5A,26B,48B,61C 'use-after-fre':4A,25B,60C 'vulner':70C 'webrtc':2A,23B,33B,66C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than 160 or Firefox ESR older than 153.7. The bug sits in WebRTC networking, so exposure is highest where calls or media features are used, but the sources do not say whether WebRTC must be actively in use. Managed desktops should be checked against their Firefox ESR pin.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: Help > About Firefox.","pkeys":[],"ptokens":[],"labels":["browsers","firefox","firefoxesr","runtime","unknown","webrtc"],"campaign_type":null,"search_a":"'-124919':13A,16A '-2026':12A,15A 'allow':8A 'cve':11A,14A 'escal':10A 'firefox':1A 'free':7A 'network':3A 'privileg':9A 'use':5A 'use-after-fre':4A 'webrtc':2A","search_b":"'attack':46B 'browser':17B,55B 'bug':29B 'caus':39B 'code':38B 'compon':35B 'escal':51B 'esr':21B 'firefox':18B,20B,31B 'firefox-esr':19B 'free':28B 'insid':53B 'let':36B 'malici':37B 'memori':40B 'network':34B 'privileg':52B 'reus':43B 'runtim':22B 'unsaf':44B 'use':26B,48B 'use-after-fre':25B 'webrtc':23B,33B","search_c":"'153.7':79C '160':75C 'compon':68C 'due':58C 'escal':57C 'esr':78C 'firefox':74C,77C 'fix':72C 'free':63C 'network':67C 'privileg':56C 'use':61C 'use-after-fre':60C 'vulner':70C 'webrtc':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124919","severity":null,"published_at":"2026-11-10T14:17:25+00:00","modified_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}