{"id":"CVE-2026-124926","kind":"vulnerability","aliases":["CVE-2026-124926"],"related":[],"title":"Firefox: incorrect boundary checks in WebRTC component allow unknown harm","description":"Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"Firefox's WebRTC component, used for real-time audio and video in the browser, has incorrect boundary condition handling. The sources do not state what an attacker gains beyond the flaw existing and being fixed in Firefox 160 and Firefox ESR 153.7.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","runtime","webrtc"],"not_affected_if":["up-to-date-firefox"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox; `unknown` if the sources do not give a command.\n- Compare against the fixed versions: Firefox 160 and Firefox ESR 153.7.","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:22+00:00","updated_at":"2026-11-10T14:24:22+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:24:22Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"unknown","title":"Firefox: incorrect boundary checks in WebRTC component allow unknown harm","impact":"medium","summary":"Firefox's WebRTC component, used for real-time audio and video in the browser, has incorrect boundary condition handling. The sources do not state what an attacker gains beyond the flaw existing and being fixed in Firefox 160 and Firefox ESR 153.7.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","webrtc","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources do not describe the impact","analyst_note":"Find the Mozilla security advisory for the Firefox 160 fix to learn the impact, trigger path and whether it is exploitable from a web page.","how_to_check":"- Check the installed Firefox version in Help > About Firefox; `unknown` if the sources do not give a command.\n- Compare against the fixed versions: Firefox 160 and Firefox ESR 153.7.","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 through its update menu.","product_name":"","needs_analyst":true,"not_affected_if":["up-to-date-firefox"],"who_is_affected":"Anyone running Firefox versions before 160 or Firefox ESR before 153.7 is potentially exposed, since WebRTC is enabled by default in the browser. The sources do not say whether the flaw is reachable from a web page or needs a call to be set up. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4478,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124926':13A,16A '-2026':12A,15A '153.7':63B,81C '160':59B,77C 'allow':8A 'attack':48B 'audio':30B 'beyond':50B 'boundari':3A,38B,65C 'browser':17B,35B 'check':4A 'compon':7A,24B,70C 'condit':39B,66C 'cve':11A,14A 'esr':62B,80C 'exist':53B 'firefox':1A,18B,21B,58B,61B,76C,79C 'fix':56B,74C 'flaw':52B 'gain':49B 'handl':40B 'harm':10A 'incorrect':2A,37B,64C 'real':28B 'real-tim':27B 'runtim':19B 'sourc':42B 'state':45B 'time':29B 'unknown':9A 'use':25B 'video':32B 'vulner':72C 'webrtc':6A,20B,23B,69C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox versions before 160 or Firefox ESR before 153.7 is potentially exposed, since WebRTC is enabled by default in the browser. The sources do not say whether the flaw is reachable from a web page or needs a call to be set up. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 through its update menu.","pkeys":[],"ptokens":[],"labels":["browser","firefox","runtime","unknown","webrtc"],"campaign_type":null,"search_a":"'-124926':13A,16A '-2026':12A,15A 'allow':8A 'boundari':3A 'check':4A 'compon':7A 'cve':11A,14A 'firefox':1A 'harm':10A 'incorrect':2A 'unknown':9A 'webrtc':6A","search_b":"'153.7':63B '160':59B 'attack':48B 'audio':30B 'beyond':50B 'boundari':38B 'browser':17B,35B 'compon':24B 'condit':39B 'esr':62B 'exist':53B 'firefox':18B,21B,58B,61B 'fix':56B 'flaw':52B 'gain':49B 'handl':40B 'incorrect':37B 'real':28B 'real-tim':27B 'runtim':19B 'sourc':42B 'state':45B 'time':29B 'use':25B 'video':32B 'webrtc':20B,23B","search_c":"'153.7':81C '160':77C 'boundari':65C 'compon':70C 'condit':66C 'esr':80C 'firefox':76C,79C 'fix':74C 'incorrect':64C 'vulner':72C 'webrtc':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124926","severity":null,"published_at":"2026-11-10T14:17:26+00:00","modified_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}