---
id: "CVE-2026-124935"
page: "https://infrastack.ai/live/CVE-2026-124935"
kind: "vulnerability"
aliases: ["CVE-2026-124935"]
title: "Firefox: undefined behavior in WebRTC networking code, fixed in 160"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["firefox", "runtime", "webrtc"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-11-10T14:17:27+00:00"
first_seen_at: "2026-11-10T14:22:19+00:00"
updated_at: "2026-11-10T14:24:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124935", "first_seen_at": "2026-11-10T14:22:19+00:00"}]
exploit_sources: []
---

# Firefox: undefined behavior in WebRTC networking code, fixed in 160

Link for people: https://infrastack.ai/live/CVE-2026-124935 (this .md is for agents)

Firefox's WebRTC networking component contains undefined behavior, meaning the code can act unpredictably when it runs. The sources do not state what an attacker can achieve from it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Firefox version with `about:support` in the address bar and compare it against the fixed versions below.

## Fix

- Firefox: move to `160` or later.
- Firefox ESR: move to `153.7` or later.

## Timeline

- 2026-11-10T14:22:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124935

## From the sources

Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_