{"id":"CVE-2026-124924","kind":"vulnerability","aliases":["CVE-2026-124924"],"related":[],"title":"Firefox: WebRender graphics boundary error can be exploited, fixed in 160","description":"Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"Firefox's WebRender graphics component has an incorrect boundary check. The sources do not say what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","runtime"],"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"how_to_check":"- Check the installed Firefox version in Firefox's About page or with `firefox --version`.\n- Compare it against the fixed releases named in the sources: Firefox `160` and Firefox ESR `153.7`.","fix":"- Firefox `160`\n- Firefox ESR `153.7`","status":"open","published_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:25+00:00","updated_at":"2026-11-10T14:24:25+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T14:24:25Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160`\n- Firefox ESR `153.7`","reach":"unknown","title":"Firefox: WebRender graphics boundary error can be exploited, fixed in 160","impact":"medium","summary":"Firefox's WebRender graphics component has an incorrect boundary check. The sources do not say what an attacker gains from it.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browsers"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources do not describe the impact","analyst_note":"Find the Mozilla security advisory for this CVE to confirm impact, trigger conditions and the affected version range (https://nvd.nist.gov/vuln/detail/CVE-2026-124924).","how_to_check":"- Check the installed Firefox version in Firefox's About page or with `firefox --version`.\n- Compare it against the fixed releases named in the sources: Firefox `160` and Firefox ESR `153.7`.","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later.","product_name":"","needs_analyst":true,"not_affected_if":["firefox-160-or-later","firefox-esr-153.7-or-later"],"who_is_affected":"Anyone running Firefox before the fixed releases named in the sources. The sources do not say what triggers the flaw or what it gives an attacker. Only installations using the affected Firefox versions are exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000735,"input_tokens":4486,"output_tokens":572,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124924':14A,17A '-2026':13A,16A '153.7':58C '160':11A,54C 'attack':38B 'boundari':4A,29B,41C 'browser':18B 'check':30B 'compon':25B,47C 'condit':42C 'cve':12A,15A 'error':5A 'esr':57C 'exploit':8A 'firefox':1A,19B,21B,53C,56C 'fix':9A,51C 'gain':39B 'graphic':3A,24B,45C 'incorrect':28B,40C 'runtim':20B 'say':35B 'sourc':32B 'vulner':49C 'webrend':2A,23B,46C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox before the fixed releases named in the sources. The sources do not say what triggers the flaw or what it gives an attacker. Only installations using the affected Firefox versions are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later.","pkeys":[],"ptokens":[],"labels":["browsers","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124924':14A,17A '-2026':13A,16A '160':11A 'boundari':4A 'cve':12A,15A 'error':5A 'exploit':8A 'firefox':1A 'fix':9A 'graphic':3A 'webrend':2A","search_b":"'attack':38B 'boundari':29B 'browser':18B 'check':30B 'compon':25B 'firefox':19B,21B 'gain':39B 'graphic':24B 'incorrect':28B 'runtim':20B 'say':35B 'sourc':32B 'webrend':23B","search_c":"'153.7':58C '160':54C 'boundari':41C 'compon':47C 'condit':42C 'esr':57C 'firefox':53C,56C 'fix':51C 'graphic':45C 'incorrect':40C 'vulner':49C 'webrend':46C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124924","severity":null,"published_at":"2026-11-10T14:17:26+00:00","modified_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}