{"id":"CVE-2026-124928","kind":"vulnerability","aliases":["CVE-2026-124928"],"related":[],"title":"Firefox: SVG component mitigation bypass fixed in Firefox 160","description":"Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160.","summary":"A bypass of a security mitigation in Firefox's SVG component was fixed in Firefox 160. The sources do not say what an attacker gains beyond bypassing the mitigation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","other"],"not_affected_if":[],"how_to_check":"- Check the installed Firefox version in the browser's About menu or with `firefox --version`, then compare it with `160`.","fix":"- Firefox: `160` or later (per the description).","status":"open","published_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:20+00:00","updated_at":"2026-11-10T14:24:20+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:24:20Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160` or later (per the description).","reach":"unknown","title":"Firefox: SVG component mitigation bypass fixed in Firefox 160","impact":"medium","summary":"A bypass of a security mitigation in Firefox's SVG component was fixed in Firefox 160. The sources do not say what an attacker gains beyond bypassing the mitigation.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and Mozilla's Firefox 160 security advisory for the impact and triggering conditions.","how_to_check":"- Check the installed Firefox version in the browser's About menu or with `firefox --version`, then compare it with `160`.","plain_action":"Update Firefox to version 160 or later.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":4455,"output_tokens":391,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124928':12A,15A '-2026':11A,14A '160':9A,33B,59C 'attack':41B 'beyond':43B 'browser':16B 'bypass':5A,19B,44B,48C 'compon':3A,28B,52C 'cve':10A,13A 'firefox':1A,8A,17B,25B,32B,58C 'fix':6A,30B,56C 'gain':42B 'mitig':4A,23B,46B,47C 'say':38B 'secur':22B 'sourc':35B 'svg':2A,27B,51C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later.","pkeys":[],"ptokens":[],"labels":["browser","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124928':12A,15A '-2026':11A,14A '160':9A 'bypass':5A 'compon':3A 'cve':10A,13A 'firefox':1A,8A 'fix':6A 'mitig':4A 'svg':2A","search_b":"'160':33B 'attack':41B 'beyond':43B 'browser':16B 'bypass':19B,44B 'compon':28B 'firefox':17B,25B,32B 'fix':30B 'gain':42B 'mitig':23B,46B 'say':38B 'secur':22B 'sourc':35B 'svg':27B","search_c":"'160':59C 'bypass':48C 'compon':52C 'firefox':58C 'fix':56C 'mitig':47C 'svg':51C 'vulner':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124928","severity":null,"published_at":"2026-11-10T14:17:26+00:00","modified_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}