{"id":"CVE-2026-124950","kind":"vulnerability","aliases":["CVE-2026-124950"],"related":[],"title":"Firefox: CSS parsing flaw lets pages bypass same-origin protection","description":"Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160.","summary":"A flaw in Firefox's CSS parsing and computation component allows a same-origin policy bypass, letting content read data across site boundaries. The description states it was fixed in Firefox 160.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["browser","firefox","runtime"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version` on the command line.\n- Versions below `160` are the ones the description names as fixed in 160.","fix":"- Firefox `160` (the fixed release named in the description).","status":"open","published_at":"2026-11-10T14:17:29+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","triaged_at":"2026-11-10T14:23:55+00:00","updated_at":"2026-11-10T14:23:55+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:23:55Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox `160` (the fixed release named in the description).","reach":"internet","title":"Firefox: CSS parsing flaw lets pages bypass same-origin protection","impact":"medium","summary":"A flaw in Firefox's CSS parsing and computation component allows a same-origin policy bypass, letting content read data across site boundaries. The description states it was fixed in Firefox 160.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"Web page reads data from other sites it should not access.","analyst_note":"Check the NVD entry and Mozilla's security advisory for the exact affected version range and severity.","how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version` on the command line.\n- Versions below `160` are the ones the description names as fixed in 160.","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox, and let it install.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":4475,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124950':14A,17A '-2026':13A,16A '160':54B,73C 'across':43B 'allow':32B 'boundari':45B 'browser':19B 'bypass':7A,38B,59C 'compon':31B,66C 'comput':30B,65C 'content':40B 'css':2A,27B,62C 'cve':12A,15A 'data':42B 'descript':47B 'firefox':1A,18A,20B,25B,53B,72C 'fix':51B,70C 'flaw':4A,23B 'let':5A,39B 'origin':10A,36B,57C 'page':6A 'pars':3A,28B,63C 'polici':37B,58C 'protect':11A 'read':41B 'runtim':21B 'same-origin':8A,34B,55C 'site':44B 'state':48B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox, and let it install.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124950':14A,17A '-2026':13A,16A 'bypass':7A 'css':2A 'cve':12A,15A 'firefox':1A,18A 'flaw':4A 'let':5A 'origin':10A 'page':6A 'pars':3A 'protect':11A 'same-origin':8A","search_b":"'160':54B 'across':43B 'allow':32B 'boundari':45B 'browser':19B 'bypass':38B 'compon':31B 'comput':30B 'content':40B 'css':27B 'data':42B 'descript':47B 'firefox':20B,25B,53B 'fix':51B 'flaw':23B 'let':39B 'origin':36B 'pars':28B 'polici':37B 'read':41B 'runtim':21B 'same-origin':34B 'site':44B 'state':48B","search_c":"'160':73C 'bypass':59C 'compon':66C 'comput':65C 'css':62C 'firefox':72C 'fix':70C 'origin':57C 'pars':63C 'polici':58C 'same-origin':55C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124950","severity":null,"published_at":"2026-11-10T14:17:29+00:00","modified_at":"2026-11-10T14:17:29+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","fetched_at":"2026-11-10T14:22:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}