CVE-2026-124903

Summary

A use-after-free vulnerability in Firefox and Thunderbird's IPC component allows an attacker to escape the sandbox after tricking a user into visiting a malicious site, leading to arbitrary code execution with the privileges of the compromised process.

Exploitability

Exploitation requires user interaction (e.g., visiting a crafted webpage) and reliable exploitation is non-trivial due to memory safety mitigations, though the high CVSS score suggests successful public or near-public proof-of-concept likely exists.

Blast radius

Successful exploitation could lead to full system compromise via sandbox escape, enabling attackers to steal sensitive data, install malware, or pivot laterally within the user's environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Firefox to version 160 or later, Firefox ESR to 115.45 or 153.7, or Thunderbird to version 160 or 153.7 as appropriate.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.