SB20261110340 - Multiple vulnerabilities in Mozilla Firefox

Description

This security bulletin contains information about 100 vulnerabilities.

1) Improper isolation or compartmentalization (CVE-ID: CVE-2026-124927)

CWE-ID: CWE-653 - Improper isolation or compartmentalization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to weaken site isolation, potentially accessing resources across site boundaries.

The vulnerability exists due to insufficient site isolation enforcement in the Graphics: WebRender component when rendering content. A remote attacker can trigger affected rendering behavior to cross intended site boundaries and potentially access otherwise isolated resources.

2) Buffer overflow (CVE-ID: CVE-2026-124942)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through invalid memory access.

The vulnerability exists due to improper pointer handling in the DOM: Streams component when processing stream operations. A remote attacker can trigger use of an invalid pointer in affected stream handling to potentially crash the browser.

3) Information disclosure (CVE-ID: CVE-2026-124941)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient information protection in the Security: RLBox component when handling isolated component processing. A remote attacker can exploit affected processing behavior to obtain information that should remain protected.

4) Protection mechanism failure (CVE-ID: CVE-2026-124940)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security protection.

The vulnerability exists due to insufficient security enforcement in the File Handling component when handling files. A remote attacker can trigger affected file processing behavior to circumvent an intended security restriction.

5) Incorrect calculation (CVE-ID: CVE-2026-124939)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect JavaScript execution, potentially disrupting browser operation.

The vulnerability exists due to incorrect just-in-time compilation in the JavaScript Engine: JIT component when compiling JavaScript. A remote attacker can supply JavaScript that is miscompiled to produce incorrect execution results and potentially disrupt browser operation.

6) Protection mechanism failure (CVE-ID: CVE-2026-124938)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security protection.

The vulnerability exists due to insufficient security enforcement in the Add-ons Manager component when handling add-on operations. A remote attacker can trigger affected add-on handling behavior to circumvent an intended security restriction.

7) Reliance on undefined behavior (CVE-ID: CVE-2026-124935)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unpredictable behavior that may disrupt real-time communication.

The vulnerability exists due to reliance on undefined behavior in the WebRTC: Networking component when processing real-time communication traffic. A remote attacker can trigger the affected processing path to potentially disrupt browser operation.

8) Insufficient verification of data authenticity (CVE-ID: CVE-2026-124934)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof security-relevant information.

The vulnerability exists due to insufficient authenticity enforcement in the Security component when handling security-relevant information. A remote attacker can trigger affected behavior to misrepresent information and potentially mislead a user about its authenticity.

9) Protection mechanism failure (CVE-ID: CVE-2026-124933)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to improper sandbox enforcement in the Console component when handling console operations. A remote attacker can trigger affected console behavior to bypass sandbox isolation.

10) Use-after-free (CVE-ID: CVE-2026-124932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics component when processing graphics content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

11) Origin validation error (CVE-ID: CVE-2026-124931)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass the same-origin policy, potentially accessing information across origin boundaries.

The vulnerability exists due to improper origin enforcement in the DOM: Core & HTML component when processing document content. A remote attacker can trigger affected cross-origin behavior to bypass origin restrictions and potentially access otherwise restricted information.

12) Information disclosure (CVE-ID: CVE-2026-124930)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient information protection in the Address Bar component when handling address bar activity. A remote attacker can exploit affected address bar behavior to obtain information that should remain protected.

13) Information disclosure (CVE-ID: CVE-2026-124929)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient information protection in the Layout: Form Controls component when processing form controls. A remote attacker can exploit affected form control behavior to obtain information that should remain protected.

14) Use-after-free (CVE-ID: CVE-2026-124948)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to incorrect boundary conditions and use-after-free in the Graphics component when processing graphics content. A remote attacker can trigger incorrect boundary handling and access to freed memory through crafted content to crash the browser or potentially execute arbitrary code.

15) Input validation error (CVE-ID: CVE-2026-124926)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting real-time communication.

The vulnerability exists due to incorrect boundary conditions in the WebRTC component when processing real-time communication operations. A remote attacker can trigger an incorrectly handled boundary case to potentially disrupt browser operation.

16) Input validation error (CVE-ID: CVE-2026-124924)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting rendering.

The vulnerability exists due to incorrect boundary conditions in the Graphics: WebRender component when rendering content. A remote attacker can supply content that reaches an incorrectly handled boundary case to potentially disrupt browser operation.

17) Use-after-free (CVE-ID: CVE-2026-124922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Transitions and Animations component when processing animated styles. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

18) Use-after-free (CVE-ID: CVE-2026-124919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to use-after-free in the WebRTC: Networking component when processing real-time communication traffic. A remote attacker can trigger access to freed memory in affected networking operations to obtain privileges beyond those intended.

19) Input validation error (CVE-ID: CVE-2026-124918)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: WebRender component when rendering content. A remote attacker can trigger incorrect boundary handling in affected rendering operations to obtain privileges beyond those intended.

20) Use-after-free (CVE-ID: CVE-2026-124917)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to use-after-free in the Widget: Gtk component when processing widget operations. A remote attacker can trigger access to freed memory in affected widget handling to bypass sandbox isolation.

21) Input validation error (CVE-ID: CVE-2026-124915)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting graphics processing.

The vulnerability exists due to incorrect boundary conditions in the Graphics: WebGPU component when processing GPU operations. A remote attacker can trigger an incorrectly handled graphics boundary case to potentially disrupt browser operation.

22) Improper isolation or compartmentalization (CVE-ID: CVE-2026-124914)

CWE-ID: CWE-653 - Improper isolation or compartmentalization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to weaken site isolation, potentially accessing resources across site boundaries.

The vulnerability exists due to insufficient site isolation enforcement in the DOM: Navigation component when handling navigation operations. A remote attacker can trigger affected navigation behavior to cross intended site boundaries and potentially access otherwise isolated resources.

23) Improper isolation or compartmentalization (CVE-ID: CVE-2026-124913)

CWE-ID: CWE-653 - Improper isolation or compartmentalization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to weaken site isolation, potentially accessing resources across site boundaries.

The vulnerability exists due to insufficient site isolation enforcement in the Networking component when handling network activity. A remote attacker can trigger affected networking behavior to cross intended site boundaries and potentially access otherwise isolated resources.

24) Insufficient verification of data authenticity (CVE-ID: CVE-2026-124912)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof security-relevant information.

The vulnerability exists due to insufficient authenticity enforcement in the DOM: Security component when handling security-relevant document behavior. A remote attacker can trigger affected behavior to misrepresent information and potentially mislead a user about its authenticity.

25) Protection mechanism failure (CVE-ID: CVE-2026-124910)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security protection.

The vulnerability exists due to insufficient security enforcement in the WebExtensions component when handling extension operations. A remote attacker can trigger affected extension behavior to circumvent an intended security restriction.

26) Protection mechanism failure (CVE-ID: CVE-2026-124923)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape browser sandbox restrictions.

The vulnerability exists due to inadequate sandbox enforcement in Firefox's Agent component when handling component operations. A remote attacker can trigger crafted operations to bypass sandbox boundaries.

27) Protection mechanism failure (CVE-ID: CVE-2026-124901)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified issue in the Networking: JAR component. A remote attacker can bypass implemented security restrictions. 

28) Protection mechanism failure (CVE-ID: CVE-2026-124937)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified issue in the Media component. A remote attacker can trick the victim into visiting a specially crafted website and bypass implemented security restrictions. 

29) Protection mechanism failure (CVE-ID: CVE-2026-124949)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified issue in the SVG component. A remote attacker can trick the victim into visiting a specially crafted website and bypass implemented security restrictions. 

30) Origin validation error (CVE-ID: CVE-2026-124950)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass the same-origin policy and potentially access cross-origin information.

The vulnerability exists due to improper origin enforcement in Firefox's CSS Parsing and Computation component when processing stylesheets. A remote attacker can supply crafted CSS to bypass origin restrictions and potentially access information belonging to another origin.

31) Input validation error (CVE-ID: CVE-2026-124947)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect processing that may compromise browser security.

The vulnerability exists due to incorrect boundary checks in Firefox's Graphics component when processing graphics content. A remote attacker can supply crafted content to trigger processing outside intended limits.

32) Buffer overflow (CVE-ID: CVE-2026-124946)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to improper handling of an invalid pointer in Firefox's JavaScript Engine: JIT component when processing JavaScript. A remote attacker can supply crafted JavaScript that triggers an invalid memory reference to potentially crash the browser.

33) Buffer overflow (CVE-ID: CVE-2026-124945)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to improper handling of an invalid pointer in Firefox's Layout: Text and Fonts component when laying out text. A remote attacker can supply crafted content that triggers an invalid memory reference to potentially crash the browser.

34) Information disclosure (CVE-ID: CVE-2026-124944)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate information protection in Firefox's Marionette component when handling automation operations. A remote attacker can exploit the disclosure weakness to potentially obtain information that should not be exposed.

35) Use-after-free (CVE-ID: CVE-2026-124943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's Layout component when laying out document content. A remote attacker can supply crafted content to trigger access to freed memory, potentially causing a crash or arbitrary code execution.

36) Spoofing attack (CVE-ID: CVE-2026-124936)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof address-bar information and deceive a user about a page's identity.

The vulnerability exists due to insufficient protection against spoofing in Firefox's Address Bar component when displaying page identity information. A remote attacker can supply crafted content to potentially cause misleading address-bar information to be displayed.

37) Protection mechanism failure (CVE-ID: CVE-2026-124928)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass an intended browser security protection.

The vulnerability exists due to incomplete security enforcement in Firefox's SVG component when processing SVG content. A remote attacker can supply crafted SVG to circumvent an intended protection.

38) Information disclosure (CVE-ID: CVE-2026-124925)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate information protection in Firefox's Layout component when laying out content. A remote attacker can supply crafted content to potentially obtain information that should not be exposed.

39) Information disclosure (CVE-ID: CVE-2026-124909)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient information protection in the Private Browsing component when handling private browsing activity. A remote attacker can exploit affected private browsing behavior to obtain information that should remain protected.

40) Protection mechanism failure (CVE-ID: CVE-2026-124921)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape browser sandbox restrictions.

The vulnerability exists due to inadequate sandbox enforcement in Firefox's Graphics: WebGPU component when processing graphics operations. A remote attacker can trigger crafted operations to bypass sandbox boundaries.

41) Use of uninitialized resource (CVE-ID: CVE-2026-124920)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in Firefox's Graphics: WebGPU component when processing graphics operations. A remote attacker can trigger crafted operations to potentially expose residual memory contents.

42) Improper Restriction of Rendered UI Layers or Frames (CVE-ID: CVE-2026-124911)

CWE-ID: CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trick a user into unintended interactions with autofill controls.

The vulnerability exists due to insufficient protection against clickjacking in the Autofill component of Firefox for Android when presenting interactive controls. A remote attacker can present deceptive content that redirects a victim's clicks to unintended autofill actions.

43) Use-after-free (CVE-ID: CVE-2026-124908)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's CSS Parsing and Computation component when processing stylesheets. A remote attacker can supply crafted CSS to trigger access to freed memory, potentially causing a crash or arbitrary code execution.

44) Use-after-free (CVE-ID: CVE-2026-124904)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's SVG component when processing SVG content. A remote attacker can supply crafted SVG to trigger access to freed memory, potentially causing a crash or arbitrary code execution.

45) Use-after-free (CVE-ID: CVE-2026-124900)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape browser sandbox restrictions.

The vulnerability exists due to use-after-free in Firefox's DOM: Service Workers component when handling service worker operations. A remote attacker can trigger crafted operations that access freed memory to bypass sandbox boundaries.

46) Use-after-free (CVE-ID: CVE-2026-124878)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's Layout: Positioned component when laying out positioned content. A remote attacker can supply crafted content to trigger access to freed memory, potentially causing a crash or arbitrary code execution.

47) Use-after-free (CVE-ID: CVE-2026-124871)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's DOM: HTML Parser component when parsing HTML content. A remote attacker can supply crafted HTML to trigger access to freed memory, potentially causing a crash or arbitrary code execution.

48) Use-after-free (CVE-ID: CVE-2026-124867)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Firefox's DOM: Editor component when handling document editing operations. A remote attacker can trigger crafted operations that access freed memory, potentially causing a crash or arbitrary code execution.

49) Input validation error (CVE-ID: CVE-2026-124852)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect processing that may compromise browser security.

The vulnerability exists due to incorrect boundary checks in Firefox's Graphics: CanvasWebGL component when processing graphics input. A remote attacker can supply crafted input to trigger processing outside intended limits.

50) Improper privilege management (CVE-ID: CVE-2026-124951)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege enforcement in the Nimbus Desktop Client component when handling client operations. A local user can trigger affected client behavior to obtain privileges beyond those intended.

51) Input validation error (CVE-ID: CVE-2026-124875)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect processing of boundary values, potentially disrupting browser operation.

The vulnerability exists due to incorrect boundary validation in the DOM: CSS Object Model component when handling CSS object model operations. A remote attacker can supply crafted web content that exercises improperly handled boundary values to potentially disrupt browser operation.

52) Use-after-free (CVE-ID: CVE-2026-124903)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to use-after-free in the IPC component when handling interprocess communication. A local user can trigger access to freed memory during interprocess communication processing to escape sandbox restrictions.

53) Race condition (CVE-ID: CVE-2026-124902)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass the same-origin policy and potentially access information across web origins.

The vulnerability exists due to a race condition in the Audio/Video component when processing media operations subject to same-origin restrictions. A remote attacker can trigger competing media operations that encounter the race condition to bypass origin isolation and potentially access information belonging to another origin.

54) Use-after-free (CVE-ID: CVE-2026-124899)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Layout: Text and Fonts component when processing text and font layout. A remote attacker can supply crafted web content that triggers access to freed memory during layout processing to crash the browser process or potentially execute arbitrary code.

55) Use-after-free (CVE-ID: CVE-2026-124898)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Editor component when handling document editing operations. A remote attacker can supply crafted web content that triggers access to freed memory during editing-related processing to crash the browser process or potentially execute arbitrary code.

56) Use-after-free (CVE-ID: CVE-2026-124895)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Storage: localStorage & sessionStorage component when handling web storage operations. A remote attacker can supply crafted web content that triggers access to freed memory during storage processing to crash the browser process or potentially execute arbitrary code.

57) Use-after-free (CVE-ID: CVE-2026-124890)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when handling document and HTML operations. A remote attacker can supply crafted web content that triggers access to freed memory during document processing to crash the browser process or potentially execute arbitrary code.

58) Use-after-free (CVE-ID: CVE-2026-124885)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics: Text component when processing text rendering operations. A remote attacker can supply crafted web content that triggers access to freed memory during text processing to crash the browser process or potentially execute arbitrary code.

59) Use-after-free (CVE-ID: CVE-2026-124882)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Parsing and Computation component when parsing styles or computing CSS values. A remote attacker can supply crafted web content that triggers access to freed memory during CSS processing to crash the browser process or potentially execute arbitrary code.

60) Use-after-free (CVE-ID: CVE-2026-124881)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Parsing and Computation component when parsing styles or computing CSS values. A remote attacker can supply crafted web content that triggers access to freed memory during CSS processing to crash the browser process or potentially execute arbitrary code.

61) Use-after-free (CVE-ID: CVE-2026-124880)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when handling document and HTML operations. A remote attacker can supply crafted web content that triggers access to freed memory during document processing to crash the browser process or potentially execute arbitrary code.

62) Use-after-free (CVE-ID: CVE-2026-124877)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Layout: Positioned component when laying out positioned page elements. A remote attacker can supply crafted web content that triggers access to freed memory during layout processing to crash the browser process or potentially execute arbitrary code.

63) Use-after-free (CVE-ID: CVE-2026-124876)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Parsing and Computation component when parsing styles or computing CSS values. A remote attacker can supply crafted web content that triggers access to freed memory during CSS processing to crash the browser process or potentially execute arbitrary code.

64) Improper access control (CVE-ID: CVE-2026-124905)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to improper enforcement of sandbox restrictions in the DOM: Navigation component when handling navigation operations. A local user can trigger navigation operations that bypass sandbox controls to escape the intended restrictions.

65) Origin validation error (CVE-ID: CVE-2026-124874)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass the same-origin policy and potentially access information across web origins.

The vulnerability exists due to improper enforcement of the same-origin policy in the Networking: HTTP component when handling HTTP operations. A remote attacker can supply crafted web content that triggers incorrectly authorized cross-origin operations to potentially access information belonging to another origin.

66) Use-after-free (CVE-ID: CVE-2026-124872)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Cycle Collector component when reclaiming objects involved in reference cycles. A remote attacker can supply crafted web content that triggers access to freed memory during cycle collection to crash the browser process or potentially execute arbitrary code.

67) Use-after-free (CVE-ID: CVE-2026-124865)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video component when processing media content. A remote attacker can supply crafted media content that triggers access to freed memory to crash the browser process or potentially execute arbitrary code.

68) Use-after-free (CVE-ID: CVE-2026-124864)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to use-after-free in the DOM: Service Workers component when processing service worker operations. A local user can trigger access to freed memory during service worker processing to escape sandbox restrictions.

69) Use-after-free (CVE-ID: CVE-2026-124863)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: HTML Parser component when parsing HTML content. A remote attacker can supply crafted HTML that triggers access to freed memory to crash the browser process or potentially execute arbitrary code.

70) Use-after-free (CVE-ID: CVE-2026-124861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to use-after-free in the Audio/Video: cubeb component when handling audio operations. A local user can trigger access to freed memory during audio processing to escape sandbox restrictions.

71) Use-after-free (CVE-ID: CVE-2026-124860)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video component when processing media content. A remote attacker can supply crafted media content that triggers access to freed memory to crash the browser process or potentially execute arbitrary code.

72) Input validation error (CVE-ID: CVE-2026-124859)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to incorrect boundary validation in the Storage: Cache API component when handling cache operations across sandbox boundaries. A local user can trigger operations that encounter incorrectly enforced boundaries to escape sandbox restrictions.

73) Use-after-free (CVE-ID: CVE-2026-124858)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: HTML Parser component when parsing HTML content. A remote attacker can supply crafted HTML that triggers access to freed memory to crash the browser process or potentially execute arbitrary code.

74) Use-after-free (CVE-ID: CVE-2026-124857)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics: Canvas2D component when processing two-dimensional canvas operations. A remote attacker can supply crafted web content that triggers access to freed memory during canvas processing to crash the browser process or potentially execute arbitrary code.

75) Use-after-free (CVE-ID: CVE-2026-124952)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video component when processing media content. A remote attacker can supply crafted media content that triggers access to freed memory to crash the browser process or potentially execute arbitrary code.

76) Use-after-free (CVE-ID: CVE-2026-124884)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript: GC component when performing garbage collection. A remote attacker can supply crafted JavaScript that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

77) Use-after-free (CVE-ID: CVE-2026-124907)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges and escape sandbox restrictions.

The vulnerability exists due to use-after-free in the Graphics: CanvasWebGL component when processing WebGL operations. A remote attacker can trigger access to freed memory through affected graphics operations to obtain elevated privileges and bypass sandbox isolation.

78) Use-after-free (CVE-ID: CVE-2026-124906)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics: WebRender component when rendering content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

79) Use-after-free (CVE-ID: CVE-2026-124897)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript: GC component when performing garbage collection. A remote attacker can supply crafted JavaScript that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

80) Buffer overflow (CVE-ID: CVE-2026-124896)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through invalid memory access.

The vulnerability exists due to improper pointer handling in the Layout: Text and Fonts component when laying out text. A remote attacker can trigger use of an invalid pointer through crafted text content to potentially crash the browser.

81) Use-after-free (CVE-ID: CVE-2026-124894)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Networking: Cookies component when handling cookies. A remote attacker can trigger access to freed memory through crafted cookie processing to crash the browser or potentially execute arbitrary code.

82) Use-after-free (CVE-ID: CVE-2026-124893)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Workers component when processing worker operations. A remote attacker can trigger access to freed memory through crafted worker activity to crash the browser or potentially execute arbitrary code.

83) Use-after-free (CVE-ID: CVE-2026-124892)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript: GC component when performing garbage collection. A remote attacker can supply crafted JavaScript that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

84) Input validation error (CVE-ID: CVE-2026-124891)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting document selection processing.

The vulnerability exists due to incorrect boundary conditions in the DOM: Selection component when processing document selections. A remote attacker can trigger an incorrectly handled selection boundary case to potentially disrupt browser operation.

85) Use-after-free (CVE-ID: CVE-2026-124889)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Parsing and Computation component when processing stylesheets. A remote attacker can supply crafted CSS that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

86) Input validation error (CVE-ID: CVE-2026-124888)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting text layout.

The vulnerability exists due to incorrect boundary conditions in the Layout: Text and Fonts component when laying out text. A remote attacker can supply content that reaches an incorrectly handled boundary case to potentially disrupt browser operation.

87) Input validation error (CVE-ID: CVE-2026-124887)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting text layout.

The vulnerability exists due to incorrect boundary conditions in the Layout: Text and Fonts component when laying out text. A remote attacker can supply content that reaches an incorrectly handled boundary case to potentially disrupt browser operation.

88) Buffer overflow (CVE-ID: CVE-2026-124886)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through invalid memory access.

The vulnerability exists due to improper pointer handling in the Layout: Text and Fonts component when laying out text. A remote attacker can trigger use of an invalid pointer through crafted text content to potentially crash the browser.

89) Input validation error (CVE-ID: CVE-2026-124853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape browser sandbox restrictions.

The vulnerability exists due to incorrect boundary validation in the Graphics: Text component when handling text-related operations across sandbox boundaries. A local user can trigger operations that encounter incorrectly enforced boundaries to escape sandbox restrictions.

90) Use-after-free (CVE-ID: CVE-2026-124883)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing document content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

91) Buffer overflow (CVE-ID: CVE-2026-124879)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through invalid memory access.

The vulnerability exists due to improper pointer handling in the Networking: Cache component when handling cached network data. A remote attacker can trigger use of an invalid pointer during cache processing to potentially crash the browser.

92) Buffer overflow (CVE-ID: CVE-2026-124873)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through invalid memory access.

The vulnerability exists due to improper pointer handling in the DOM: Editor component when processing editing operations. A remote attacker can trigger use of an invalid pointer to potentially crash the browser.

93) Input validation error (CVE-ID: CVE-2026-124870)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting garbage collection.

The vulnerability exists due to incorrect boundary conditions in the JavaScript: GC component when performing garbage collection. A remote attacker can trigger an incorrectly handled boundary case through JavaScript execution to potentially disrupt browser operation.

94) Use-after-free (CVE-ID: CVE-2026-124869)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing document content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

95) Input validation error (CVE-ID: CVE-2026-124868)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting document processing.

The vulnerability exists due to incorrect boundary conditions in the DOM: Core & HTML component when processing document content. A remote attacker can supply input that reaches an incorrectly handled boundary case to potentially disrupt browser operation.

96) Use-after-free (CVE-ID: CVE-2026-124866)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Layout component when laying out document content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

97) Use-after-free (CVE-ID: CVE-2026-124862)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing document content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

98) Input validation error (CVE-ID: CVE-2026-124856)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect handling of boundary cases, potentially disrupting HTTP processing.

The vulnerability exists due to incorrect boundary conditions in the Networking: HTTP component when processing HTTP traffic. A remote attacker can supply input that reaches an incorrectly handled boundary case to potentially disrupt browser operation.

99) Protection mechanism failure (CVE-ID: CVE-2026-124855)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to improper sandbox enforcement in the DOM: Navigation component when handling navigation operations. A remote attacker can trigger affected navigation behavior to bypass sandbox isolation.

100) Improper privilege management (CVE-ID: CVE-2026-124854)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege enforcement in the DOM: Navigation component when handling navigation operations. A remote attacker can trigger affected navigation behavior to obtain privileges beyond those intended.

Remediation

Install update from vendor's website.

References

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-127/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2078669
• https://bugzilla.mozilla.org/show_bug.cgi?id=2077728
• https://bugzilla.mozilla.org/show_bug.cgi?id=2077405
• https://bugzilla.mozilla.org/show_bug.cgi?id=2076948
• https://bugzilla.mozilla.org/show_bug.cgi?id=2076663
• https://bugzilla.mozilla.org/show_bug.cgi?id=2075948
• https://bugzilla.mozilla.org/show_bug.cgi?id=2061793
• https://bugzilla.mozilla.org/show_bug.cgi?id=1847625
• https://bugzilla.mozilla.org/show_bug.cgi?id=2085424
• https://bugzilla.mozilla.org/show_bug.cgi?id=2084555
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083990
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082172
• https://bugzilla.mozilla.org/show_bug.cgi?id=2080889
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081960
• https://bugzilla.mozilla.org/show_bug.cgi?id=2077727
• https://bugzilla.mozilla.org/show_bug.cgi?id=2076710
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074190
• https://bugzilla.mozilla.org/show_bug.cgi?id=2061331
• https://bugzilla.mozilla.org/show_bug.cgi?id=2058993
• https://bugzilla.mozilla.org/show_bug.cgi?id=2058648
• https://bugzilla.mozilla.org/show_bug.cgi?id=2056172
• https://bugzilla.mozilla.org/show_bug.cgi?id=2056107
• https://bugzilla.mozilla.org/show_bug.cgi?id=2045704
• https://bugzilla.mozilla.org/show_bug.cgi?id=2025197
• https://bugzilla.mozilla.org/show_bug.cgi?id=1792485
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-125/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074806
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-126/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083626
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074123
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082327
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083733
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081249
• https://bugzilla.mozilla.org/show_bug.cgi?id=2080789
• https://bugzilla.mozilla.org/show_bug.cgi?id=2080119
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079176
• https://bugzilla.mozilla.org/show_bug.cgi?id=2078990
• https://bugzilla.mozilla.org/show_bug.cgi?id=2072573
• https://bugzilla.mozilla.org/show_bug.cgi?id=2080652
• https://bugzilla.mozilla.org/show_bug.cgi?id=2077035
• https://bugzilla.mozilla.org/show_bug.cgi?id=1730261
• https://bugzilla.mozilla.org/show_bug.cgi?id=2073651
• https://bugzilla.mozilla.org/show_bug.cgi?id=2062097
• https://bugzilla.mozilla.org/show_bug.cgi?id=1991276
• https://bugzilla.mozilla.org/show_bug.cgi?id=2088651
• https://bugzilla.mozilla.org/show_bug.cgi?id=2086062
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083116
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081940
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079678
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079050
• https://bugzilla.mozilla.org/show_bug.cgi?id=2001244
• https://bugzilla.mozilla.org/show_bug.cgi?id=2085124
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081380
• https://bugzilla.mozilla.org/show_bug.cgi?id=2084673
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083629
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082451
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082205
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082109
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082039
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082006
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081982
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081980
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081966
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081939
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081550
• https://bugzilla.mozilla.org/show_bug.cgi?id=2086254
• https://bugzilla.mozilla.org/show_bug.cgi?id=2080420
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079689
• https://bugzilla.mozilla.org/show_bug.cgi?id=2076414
• https://bugzilla.mozilla.org/show_bug.cgi?id=2075976
• https://bugzilla.mozilla.org/show_bug.cgi?id=2075975
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074210
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074194
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074179
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074172
• https://bugzilla.mozilla.org/show_bug.cgi?id=2073695
• https://bugzilla.mozilla.org/show_bug.cgi?id=2071647
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081994
• https://bugzilla.mozilla.org/show_bug.cgi?id=2087324
• https://bugzilla.mozilla.org/show_bug.cgi?id=2086296
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082186
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082181
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082101
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082097
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082083
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082075
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082033
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082025
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082024
• https://bugzilla.mozilla.org/show_bug.cgi?id=2082021
• https://bugzilla.mozilla.org/show_bug.cgi?id=2058035
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081991
• https://bugzilla.mozilla.org/show_bug.cgi?id=2081949
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079937
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079466
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079170
• https://bugzilla.mozilla.org/show_bug.cgi?id=2079169
• https://bugzilla.mozilla.org/show_bug.cgi?id=2078993
• https://bugzilla.mozilla.org/show_bug.cgi?id=2074220
• https://bugzilla.mozilla.org/show_bug.cgi?id=2072437
• https://bugzilla.mozilla.org/show_bug.cgi?id=2072096
• https://bugzilla.mozilla.org/show_bug.cgi?id=2060230