CVE-2026-124859Mozilla Firefox

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124859. Nothing runs until you send it.

About this flaw

Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Published: 10 Nov 2026

What should I do about this?

Advisories and references