First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-124926

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-124927Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, CVE-2026-124928Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249294.3Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 1 CVE-2026-124937.5The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record CVE-2026-1249304.3Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Th CVE-2026-124931Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160 CVE-2026-1249328.8Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1 CVE-2026-124933Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 15 CVE-2026-124934Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1 CVE-2026-124935Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and CVE-2026-124936Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124937Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.

CVE-2026-124926: High severity, CVSS 8.8 | Vulnix