CVE-2026-124864Mozilla Firefox

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Reading the vendor advisory

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124864. Nothing runs until you send it.

About this flaw

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Published: 10 Nov 2026

What should I do about this?

Advisories and references