Race condition in Mozilla products - CVE-2026-124902
Published: November 10, 2026
Vulnerability identifier: #VU164514
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-124902
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass the same-origin policy and potentially access information across web origins.
The vulnerability exists due to a race condition in the Audio/Video component when processing media operations subject to same-origin restrictions. A remote attacker can trigger competing media operations that encounter the race condition to bypass origin isolation and potentially access information belonging to another origin.
Affected software
Firefox for Android
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Firefox ESR
How to mitigate CVE-2026-124902
Install security update from vendor's website.
Firefox for Android - update to 160.0
Mozilla Firefox - update to 160.0
Firefox ESR - addressed in versions 115.45.0, 153.7.0
Mozilla Firefox - update to 160.0
Firefox ESR - addressed in versions 115.45.0, 153.7.0