CVE-2026-124917

Summary

A use-after-free flaw in Firefox's Widget: Gtk component allows a sandbox escape when triggered via a malicious web page, enabling attackers to break out of the browser's sandbox and execute arbitrary code with the privileges of the compromised process. This is critical due to the high impact on confidentiality, integrity, and availability.

Exploitability

Exploitation requires user interaction (e.g., visiting a crafted webpage) and precise memory manipulation, making it non-trivial but feasible for skilled attackers given the sandbox escape context.

Blast radius

Successful exploitation could lead to full system compromise via arbitrary code execution outside the browser sandbox, affecting all users on vulnerable installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Firefox 160, Firefox ESR 153.7, Thunderbird 160, or Thunderbird 153.7 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.