CVE-2026-124938

Not scored yetLast modified Nov 10, 2026

Description

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-124939JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160,CVE-2026-124940Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThundCVE-2026-1249414.3Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, anCVE-2026-124942Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThunderbCVE-2026-1249438.8Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249444.3Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124945Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124946Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249478.8Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249488.8Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, ThuCVE-2026-124949Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124955.3Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web
CVE-2026-124938: Unscored | Vulnix