CVE-2026-124859

Summary

A sandbox escape vulnerability in Firefox and Thunderbird's Storage: Cache API stems from incorrect boundary checks (CWE-120), allowing an attacker to break out of the browser sandbox and execute arbitrary code with full privileges. The flaw requires user interaction (e.g., visiting a malicious site) and affects versions prior to the specified fixed releases.

Exploitability

Exploitation requires social engineering to诱导 the user to visit a crafted webpage, but the low attack complexity and lack of privilege requirements make it highly feasible for targeted attacks.

Blast radius

Successful exploitation would grant attackers full system compromise within the victim's user context, enabling data theft, lateral movement, or persistent access across the host.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, or Thunderbird 153.7 immediately; for environments unable to patch, disable the Cache API via about:config (dom.caches.enabled = false) as a temporary mitigation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.