CVE-2026-124942

Invalid pointer in the DOM: Streams component

Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124948

Incorrect boundary conditions, use-after-free in the Graphics component

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124951

Privilege escalation in the Nimbus Desktop Client component

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124852

Incorrect boundary conditions in the Graphics: CanvasWebGL component

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124867

Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124871

Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124878

Use-after-free in the Layout: Positioned component

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124900

Sandbox escape due to use-after-free in the DOM: Service Workers component

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124904

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124908

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124911

Clickjacking issue in the Autofill component in Firefox for Android

Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-124920

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124921

Sandbox escape in the Graphics: WebGPU component

Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124923

Sandbox escape in the Agent component

Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124925

Information disclosure in the Layout component

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124928

Mitigation bypass in the SVG component

Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124936

Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124937

Other issue in the Media component in Firefox for Android

Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-124943

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-124945

Invalid pointer in the Layout: Text and Fonts component

Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird