CVE-2026-124853
UnknownSummary
A sandbox escape vulnerability due to incorrect boundary conditions exists in the Graphics: Text component of Firefox. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Risk Assessment
A sandbox escape can allow code execution outside the browser's isolation, increasing the risk of system compromise via a malicious website. Organizations using vulnerable Firefox versions are exposed.
Recommendation
Update Firefox to version 160, Firefox ESR 115.45, or Firefox ESR 153.7 (or later).
Other vulnerabilities in Firefox
See all- CVE-2026-124951Unknown
Privilege escalation vulnerability in the Nimbus Desktop Client component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124950Unknown
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124949Unknown
An unspecified vulnerability in the SVG component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124948High
Vulnerability caused by incorrect boundary conditions and use-after-free in the Graphics component of Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124947High
Vulnerability caused by incorrect boundary conditions in the Graphics component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124946Unknown
Invalid pointer vulnerability in the JavaScript Engine: JIT component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124945Unknown
Invalid pointer vulnerability in the Layout: Text and Fonts component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124944Medium
Information disclosure vulnerability in the Marionette component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124943High
Use-after-free vulnerability in the Layout component of Firefox. It was fixed in Firefox 160.
- CVE-2026-124942Unknown
Invalid pointer in the DOM: Streams component of Firefox. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
Original NVD description (English source)
Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS