---
id: "CVE-2026-124946"
page: "https://infrastack.ai/live/CVE-2026-124946"
kind: "vulnerability"
aliases: ["CVE-2026-124946"]
title: "Firefox: invalid pointer in JavaScript JIT lets attackers corrupt memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Firefox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "firefox", "runtime"]
not_affected_if: ["firefox-160-or-later"]
published_at: "2026-11-10T14:17:28+00:00"
first_seen_at: "2026-11-10T14:22:20+00:00"
updated_at: "2026-11-10T14:23:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124946", "first_seen_at": "2026-11-10T14:22:20+00:00"}]
exploit_sources: []
---

# Firefox: invalid pointer in JavaScript JIT lets attackers corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-124946 (this .md is for agents)

Firefox's JavaScript engine has an invalid pointer bug in its JIT component, which compiles JavaScript to machine code. The sources do not say what an attacker can achieve beyond memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Firefox affected range not listed fixed no fixed version listed

## How to check

- Check the Firefox version with Help > About Firefox; versions before `160` are affected per the source

## Fix

- Firefox: move to `160` or later

## Timeline

- 2026-11-10T14:22:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124946

## From the sources

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_