Critical Firefox sandbox escape flaws: update to Firefox 160 or the latest ESR

What happened

On November 10, 2026, Mozilla released security updates for the Firefox browser. They fix dozens of bugs, most of which Mozilla itself rates as high impact. This article focuses on four of them: CVE-2026-124861, CVE-2026-124864, CVE-2026-124903 and CVE-2026-124917. All of them are use-after-free bugs that, according to Mozilla, can lead to a sandbox escape, meaning a way out of the browser’s security isolation.

CVE-2026-124861: the audio and video module (Audio/Video: cubeb)
CVE-2026-124864: Service Workers, the scripts websites run in the background
CVE-2026-124903: IPC, the communication between the browser’s internal processes
CVE-2026-124917: Widget: Gtk, the part that draws windows and controls on Linux

At least three of these bugs were found by Mozilla’s own developers. Neither Mozilla nor ENISA’s European vulnerability database EUVD reports any exploitation so far, and the bugs are not in the CISA KEV catalog. The fixes are in Firefox 160, Firefox ESR 115.45 and Firefox ESR 153.7.

Why it is dangerous

Use-after-free means exactly what it says: a program reserves a piece of memory, hands it back, and then mistakenly uses it again. Picture returning your hotel key card, yet the door still opens for you even though someone else now has the room. An attacker can try to plant their own data in that freed space and change how the program behaves.

A sandbox is a fenced-off play area. Firefox runs website content in restricted processes that have no direct access to files or the rest of the system. A sandbox escape means code from a web page gets past that fence and gains the rights of the logged-in user. In practice, attackers usually chain such a bug with another one that first lets them run code inside the sandbox.

According to the CVSS vector in the NVD database, the attack works over the network and the attacker does not need to log in anywhere. They do need the user to do something, such as open a malicious page or link. A successful attack could lead to data theft, data tampering and outages. A compromised computer can then serve as the attacker’s entry point into the company network.

CVSS is an international severity scale running up to ten. All four bugs carry a score of 9.6 under CVSS 3.1 in NVD, which is the critical level. This score was not assigned by NVD itself but by another organization that NVD lists only by an internal identifier. In its own advisories, Mozilla rates the impact of these bugs as “high”.

The CISA KEV catalog lists vulnerabilities that the US agency CISA knows are being actively exploited. These bugs are not in it so far. An EPSS score, which estimates the likelihood of exploitation in the next 30 days, has not been published for them yet.

Who is affected

This affects anyone running Firefox on a computer, whether on Windows, macOS or Linux. The vulnerable versions are:

Firefox before 160
Firefox ESR 115 branch before 115.45
Firefox ESR 153 branch before 153.7

According to its NVD description, CVE-2026-124917 in the Gtk component was fixed in Firefox 160 and ESR 153.7, and the ESR 115 branch is not listed for this bug. The Gtk component is used mainly by the Linux version of Firefox.

ESR (Extended Support Release) is the long-term support edition, popular with companies, schools and public offices because it changes less often. Typical environments are company laptops and desktops, terminal servers and virtual desktops where staff browse the web and read email. Mozilla’s advisories list only Firefox and Firefox ESR as affected products.

How to check if you are affected

The easiest way is to open about:support in Firefox and look at the Version line. The Help > About Firefox menu shows the version too, but it also starts downloading the update.

On a server or across many machines, you can check the version with commands that change nothing. Linux:

firefox --version
dpkg -l | grep -i firefox
rpm -qa | grep -i firefox
snap list firefox

Windows (PowerShell):

(Get-Item 'C:\Program Files\Mozilla Firefox\firefox.exe').VersionInfo.ProductVersion

macOS:

/Applications/Firefox.app/Contents/MacOS/firefox --version

If regular Firefox shows a version below 160, ESR 115 below 115.45 or ESR 153 below 153.7, the machine is vulnerable. In companies, also check the software inventory in your device management tool, such as Intune or SCCM.

How to fix it

Mozilla released the fixed versions on November 10, 2026:

Firefox 160
Firefox ESR 115.45
Firefox ESR 153.7

How to update:

Single computer: open Help > About Firefox, let it download the update and restart the browser.
Linux: update through your distribution’s package manager (apt, dnf, snap). If the fixed package is not available yet, watch your distribution’s security announcements.
Companies: roll out the new version through central management (GPO, Intune, SCCM or MDM) and make sure your policies do not disable automatic updates.
Always restart the browser after updating. While the old instance is still running, the fix does not take effect.
Finally, check the version again using the steps in the checking section.

Order of work: first the machines of people with access to sensitive data and systems (management, accounting, IT admins), then terminal servers and shared workstations, then everything else.

Mozilla does not list any workaround, so updating is the only real protection. Until the update is deployed, remind users not to open links from unknown emails and messages. If some machines cannot be updated right away, consider temporarily using another, up-to-date browser on them.

What if you may already be compromised

Neither Mozilla nor any other source has published indicators of compromise, and no exploitation of these bugs is known so far. The risk is therefore mostly a future one, but it is worth checking your machines for anything unusual:

antivirus or EDR alerts, especially suspicious processes launched by Firefox, such as a command prompt or PowerShell
unknown Firefox extensions (about:addons)
new or unknown user accounts and scheduled tasks
unusual outbound connections from workstations in firewall or proxy logs
email or cloud logins from unusual locations

If you find something suspicious, disconnect the computer from the network but do not switch it off, so traces in memory are preserved. Change the passwords used on that machine from a different, clean device. If you have a real suspicion, bring in an incident response specialist, because a browser attack is often only the first step.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.