---
id: "CVE-2026-124942"
page: "https://infrastack.ai/live/CVE-2026-124942"
kind: "vulnerability"
aliases: ["CVE-2026-124942"]
title: "Firefox: invalid pointer in DOM Streams lets a page crash or run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "firefox", "firefox-esr", "runtime"]
not_affected_if: ["already-updated"]
published_at: "2026-11-10T14:17:28+00:00"
first_seen_at: "2026-11-10T14:22:19+00:00"
updated_at: "2026-11-10T14:24:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124942", "first_seen_at": "2026-11-10T14:22:19+00:00"}]
exploit_sources: []
---

# Firefox: invalid pointer in DOM Streams lets a page crash or run code

Link for people: https://infrastack.ai/live/CVE-2026-124942 (this .md is for agents)

Firefox has an invalid pointer bug in its DOM Streams component, which handles streamed web data in the browser. The sources do not say what an attacker gets beyond the memory fault class, so the impact is unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line.
- Compare against the fixed versions below; a version earlier than `160` on Firefox, or earlier than `153.7` on the ESR line, is affected.

## Fix

- Firefox: `160`
- Firefox ESR: `153.7`

## Timeline

- 2026-11-10T14:22:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124942

## From the sources

Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_