CVE-2026-124900Mozilla Firefox

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

Fix it in one click

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124900. Nothing runs until you send it.

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124900. Nothing runs until you send it.

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.