CVE-2026-124853

Summary

A sandbox escape vulnerability exists in Firefox and Thunderbird's Graphics: Text component due to incorrect boundary condition handling, allowing an attacker to break out of the browser's sandbox and execute arbitrary code with the privileges of the compromised process. This is critical because it enables full system compromise via a single user-clicked malicious link or webpage.

Exploitability

Exploitation requires user interaction (e.g., visiting a crafted webpage) and relies on triggering the boundary flaw in text rendering, but no public exploit code is available as of the description date.

Blast radius

Successful exploitation would allow attackers to fully compromise affected systems, steal sensitive data, install persistent backdoors, or pivot laterally within enterprise networks where users run vulnerable versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Firefox to version 160 or later, Firefox ESR to 115.45 or later, Firefox ESR 153.x to 153.7 or later, Thunderbird to version 160 or later, or Thunderbird 153.x to 153.7 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.