CVE-2026-124900

Summary

A use-after-free flaw in Firefox and Thunderbird's DOM Service Workers component allows an attacker to escape the browser sandbox after tricking a user into visiting a malicious site. This enables full compromise of the application's memory space.

Exploitability

Exploitation requires user interaction (e.g., visiting a crafted webpage) and precise memory manipulation due to the use-after-free nature, making reliable exploitation non-trivial but feasible for advanced attackers.

Blast radius

Successful exploitation grants attackers full access to the victim's browser process, enabling data theft, credential harvesting, or lateral movement within the user's session.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Firefox to version 160 or later, or upgrade Thunderbird to version 160 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.