{"id":"CVE-2026-124942","kind":"vulnerability","aliases":["CVE-2026-124942"],"related":[],"title":"Firefox: invalid pointer in DOM Streams lets a page crash or run code","description":"Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"Firefox has an invalid pointer bug in its DOM Streams component, which handles streamed web data in the browser. The sources do not say what an attacker gets beyond the memory fault class, so the impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","firefox-esr","runtime"],"not_affected_if":["already-updated"],"how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.\n- Compare against the fixed versions below; a version earlier than `160` on Firefox, or earlier than `153.7` on the ESR line, is affected.","fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","status":"open","published_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","triaged_at":"2026-11-10T14:24:05+00:00","updated_at":"2026-11-10T14:24:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:24:05Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `153.7`","reach":"internet","title":"Firefox: invalid pointer in DOM Streams lets a page crash or run code","impact":"high","summary":"Firefox has an invalid pointer bug in its DOM Streams component, which handles streamed web data in the browser. The sources do not say what an attacker gets beyond the memory fault class, so the impact is unconfirmed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources only name an invalid pointer in DOM Streams","analyst_note":"Check the Mozilla security advisory for this CVE for exploitability, trigger conditions and whether it is memory corruption exploitable from a web page.","how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.\n- Compare against the fixed versions below; a version earlier than `160` on Firefox, or earlier than `153.7` on the ESR line, is affected.","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: open the menu, choose Help, then About Firefox, and let it install.","product_name":"","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Any user of Firefox or Firefox ESR before the fixed versions, since the flaw sits in the browser's own DOM Streams code and a web page can reach it. Organizations running Firefox ESR on managed desktops are in scope. The sources do not say whether a user has to visit a crafted page.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4474,"output_tokens":630,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124942':16A,19A '-2026':15A,18A '153.7':81C '160':77C 'attack':52B 'beyond':54B 'browser':20B,44B 'bug':31B 'class':58B 'code':13A 'compon':36B,70C 'crash':10A 'cve':14A,17A 'data':41B 'dom':5A,34B,68C 'esr':24B,80C 'fault':57B 'firefox':1A,21B,23B,26B,76C,79C 'firefox-esr':22B 'fix':74C 'get':53B 'handl':38B 'impact':61B 'invalid':2A,29B,64C 'let':7A 'memori':56B 'page':9A 'pointer':3A,30B,65C 'run':12A 'runtim':25B 'say':49B 'sourc':46B 'stream':6A,35B,39B,69C 'unconfirm':63B 'vulner':72C 'web':40B","nicknames":[],"mitigations":[],"who_affected":"Any user of Firefox or Firefox ESR before the fixed versions, since the flaw sits in the browser's own DOM Streams code and a web page can reach it. Organizations running Firefox ESR on managed desktops are in scope. The sources do not say whether a user has to visit a crafted page.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later: open the menu, choose Help, then About Firefox, and let it install.","pkeys":[],"ptokens":[],"labels":["browser","firefox","firefoxesr","runtime","unknown"],"campaign_type":null,"search_a":"'-124942':16A,19A '-2026':15A,18A 'code':13A 'crash':10A 'cve':14A,17A 'dom':5A 'firefox':1A 'invalid':2A 'let':7A 'page':9A 'pointer':3A 'run':12A 'stream':6A","search_b":"'attack':52B 'beyond':54B 'browser':20B,44B 'bug':31B 'class':58B 'compon':36B 'data':41B 'dom':34B 'esr':24B 'fault':57B 'firefox':21B,23B,26B 'firefox-esr':22B 'get':53B 'handl':38B 'impact':61B 'invalid':29B 'memori':56B 'pointer':30B 'runtim':25B 'say':49B 'sourc':46B 'stream':35B,39B 'unconfirm':63B 'web':40B","search_c":"'153.7':81C '160':77C 'compon':70C 'dom':68C 'esr':80C 'firefox':76C,79C 'fix':74C 'invalid':64C 'pointer':65C 'stream':69C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124942","severity":null,"published_at":"2026-11-10T14:17:28+00:00","modified_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","fetched_at":"2026-11-10T14:22:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}