{"id":"CVE-2026-124929","kind":"vulnerability","aliases":["CVE-2026-124929"],"related":[],"title":"Firefox: Layout form controls component leaks information to attackers","description":"Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A flaw in the Layout Form Controls component of Firefox lets an attacker read information it should not expose. The description does not say what data leaks or how the attack is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","other"],"not_affected_if":["up-to-date-firefox"],"how_to_check":"- Check the Firefox version with the About Firefox dialog or `firefox --version`; the sources name Firefox 160 and Firefox ESR 153.7 as the fixed releases.","fix":"- Firefox `160` and Firefox ESR `153.7` (the sources state these versions contain the fix).","status":"open","published_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:18+00:00","updated_at":"2026-11-10T14:24:18+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:24:18Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160` and Firefox ESR `153.7` (the sources state these versions contain the fix).","reach":"unknown","title":"Firefox: Layout form controls component leaks information to attackers","impact":"low","summary":"A flaw in the Layout Form Controls component of Firefox lets an attacker read information it should not expose. The description does not say what data leaks or how the attack is triggered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown information disclosure from the browser","analyst_note":"Read the Mozilla security advisory for the Firefox 160 fix to learn what information leaks and how it is triggered; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124929.","how_to_check":"- Check the Firefox version with the About Firefox dialog or `firefox --version`; the sources name Firefox 160 and Firefox ESR 153.7 as the fixed releases.\n- unknown for other checks; the sources do not say.","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later.","product_name":"","needs_analyst":true,"not_affected_if":["up-to-date-firefox"],"who_is_affected":"unknown. The sources say only that the flaw is in the Layout Form Controls component of Firefox and was fixed in Firefox 160 and Firefox ESR 153.7. Anyone running an older Firefox build is presumably exposed, but the sources do not describe the trigger or the data exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000747,"input_tokens":4476,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124929':12A,15A '-2026':11A,14A '153.7':69C '160':65C 'attack':9A,30B,48B 'browser':16B 'compon':5A,25B,58C 'control':4A,24B,57C 'cve':10A,13A 'data':43B 'descript':38B 'disclosur':52C 'esr':68C 'expos':36B 'firefox':1A,17B,27B,64C,67C 'fix':62C 'flaw':19B 'form':3A,23B,56C 'inform':7A,32B,51C 'layout':2A,22B,55C 'leak':6A,44B 'let':28B 'read':31B 'say':41B 'trigger':50B 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR 153.7 or later.","pkeys":[],"ptokens":[],"labels":["browser","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124929':12A,15A '-2026':11A,14A 'attack':9A 'compon':5A 'control':4A 'cve':10A,13A 'firefox':1A 'form':3A 'inform':7A 'layout':2A 'leak':6A","search_b":"'attack':30B,48B 'browser':16B 'compon':25B 'control':24B 'data':43B 'descript':38B 'expos':36B 'firefox':17B,27B 'flaw':19B 'form':23B 'inform':32B 'layout':22B 'leak':44B 'let':28B 'read':31B 'say':41B 'trigger':50B","search_c":"'153.7':69C '160':65C 'compon':58C 'control':57C 'disclosur':52C 'esr':68C 'firefox':64C,67C 'fix':62C 'form':56C 'inform':51C 'layout':55C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124929","severity":null,"published_at":"2026-11-10T14:17:26+00:00","modified_at":"2026-11-10T14:17:26+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}