CVE-2026-124853

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 160 Firefox ESR versions prior to 115.45 Firefox ESR versions prior to 153.7 Thunderbird (affected versions not specified)

Description Incorrect boundary conditions in the Graphics: Text component allow a crafted text rendering path to escape the content sandbox, which is the security boundary designed to isolate web content from the rest of the system. This allows for the execution of code outside the renderer process. The issue is only exploitable when the text rendering pipeline is reached.

Recommendations Update Firefox to version 160. Update Firefox ESR to version 115.45. Update Firefox ESR to version 153.7. Update Thunderbird to version 160.