{"id":"CVE-2026-124944","kind":"vulnerability","aliases":["CVE-2026-124944"],"related":[],"title":"Firefox: Marionette component leaks information to attackers","description":"Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.","summary":"Firefox's Marionette component, the remote-control interface used for browser automation, can disclose information. The sources do not say what information or what an attacker must do to reach it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser-automation","firefox","other"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the Firefox version with `firefox --version`; versions before 160 are affected by this report.\n- Check whether Marionette is enabled, for example with the `marionette.enabled` preference in about:config.","fix":"- Firefox: move to `160` or later.","status":"open","published_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","triaged_at":"2026-11-10T14:24:04+00:00","updated_at":"2026-11-10T14:24:04+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:24:04Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later.","reach":"unknown","title":"Firefox: Marionette component leaks information to attackers","impact":"low","summary":"Firefox's Marionette component, the remote-control interface used for browser automation, can disclose information. The sources do not say what information or what an attacker must do to reach it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser-automation"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown information disclosed from the browser","analyst_note":"Find the Mozilla advisory for CVE-2026-124944 to confirm what information leaks, whether Marionette must be enabled, and the exact affected range.","how_to_check":"- Check the Firefox version with `firefox --version`; versions before 160 are affected by this report.\n- Check whether Marionette is enabled, for example with the `marionette.enabled` preference in about:config.","plain_action":"Update Firefox to version 160 or later.","product_name":"","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"Firefox installs before version 160 are affected. Systems that run Firefox with Marionette enabled, such as browser automation or test setups, are the ones most likely to expose the interface. Sources do not say whether ordinary desktop use is affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000709,"input_tokens":4453,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124944':10A,13A '-2026':9A,12A '160':61C 'attack':7A,44B 'autom':16B,30B 'browser':15B,29B 'browser-autom':14B 'compon':3A,21B,54C 'control':25B 'cve':8A,11A 'disclos':32B 'disclosur':50C 'firefox':1A,17B,18B,60C 'fix':58C 'inform':5A,33B,40B,49C 'interfac':26B 'leak':4A 'marionett':2A,20B,53C 'must':45B 'reach':48B 'remot':24B 'remote-control':23B 'say':38B 'sourc':35B 'use':27B 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Firefox installs before version 160 are affected. Systems that run Firefox with Marionette enabled, such as browser automation or test setups, are the ones most likely to expose the interface. Sources do not say whether ordinary desktop use is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later.","pkeys":[],"ptokens":[],"labels":["browserautomation","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124944':10A,13A '-2026':9A,12A 'attack':7A 'compon':3A 'cve':8A,11A 'firefox':1A 'inform':5A 'leak':4A 'marionett':2A","search_b":"'attack':44B 'autom':16B,30B 'browser':15B,29B 'browser-autom':14B 'compon':21B 'control':25B 'disclos':32B 'firefox':17B,18B 'inform':33B,40B 'interfac':26B 'marionett':20B 'must':45B 'reach':48B 'remot':24B 'remote-control':23B 'say':38B 'sourc':35B 'use':27B","search_c":"'160':61C 'compon':54C 'disclosur':50C 'firefox':60C 'fix':58C 'inform':49C 'marionett':53C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124944","severity":null,"published_at":"2026-11-10T14:17:28+00:00","modified_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","fetched_at":"2026-11-10T14:22:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}