{"id":"CVE-2026-124859","published":"2026-11-10T14:17:18.210","lastModified":"2026-11-10T21:19:09.913","description":"Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2074179","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-125/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-126/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-127/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-128/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-129/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A sandbox escape vulnerability in Firefox and Thunderbird's Storage: Cache API stems from incorrect boundary checks (CWE-120), allowing an attacker to break out of the browser sandbox and execute arbitrary code with full privileges. The flaw requires user interaction (e.g., visiting a malicious site) and affects versions prior to the specified fixed releases.","exploitability":"Exploitation requires social engineering to诱导 the user to visit a crafted webpage, but the low attack complexity and lack of privilege requirements make it highly feasible for targeted attacks.","blast_radius":"Successful exploitation would grant attackers full system compromise within the victim's user context, enabling data theft, lateral movement, or persistent access across the host.","remediation":"Upgrade to Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, or Thunderbird 153.7 immediately; for environments unable to patch, disable the Cache API via about:config (dom.caches.enabled = false) as a temporary mitigation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sandbox-escape","memory-corruption","browser","web-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:54:24.000Z"}}