CVE-2026-124933

Not scored yetLast modified Nov 10, 2026

Description

Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-124934Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1CVE-2026-124935Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, andCVE-2026-124936Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124937Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.CVE-2026-124938Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThuCVE-2026-124939JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160,CVE-2026-124940Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThundCVE-2026-1249414.3Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, anCVE-2026-124942Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThunderbCVE-2026-1249438.8Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249444.3Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124945Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124933: Unscored | Vulnix