CVE-2026-124930

MediumCVSS 4.3/10Last modified Nov 10, 2026

Description

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-124931Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160CVE-2026-1249328.8Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1CVE-2026-124933Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 15CVE-2026-124934Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1CVE-2026-124935Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, andCVE-2026-124936Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124937Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.CVE-2026-124938Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThuCVE-2026-124939JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160,CVE-2026-124940Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThundCVE-2026-1249414.3Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, anCVE-2026-124942Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderb
CVE-2026-124930: Medium severity, CVSS 4.3 | Vulnix