CVE-2026-124864

Summary

A use-after-free vulnerability in Firefox and Thunderbird's DOM Service Workers component allows an attacker to escape the browser sandbox via a specially crafted web page, leading to arbitrary code execution with the privileges of the compromised process.

Exploitability

Exploitation requires user interaction (e.g., visiting a malicious website) and precise memory manipulation due to the use-after-free nature, but low attack complexity makes it feasible for skilled attackers.

Blast radius

Successful exploitation could lead to full system compromise via sandbox escape, enabling theft of sensitive data, installation of malware, or lateral movement within the user's environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, or Thunderbird 153.7 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.