Firefox 160 sandbox escape fixes address seven critical vulnerabilities in browser components. Update standard Firefox to version 160, then verify ESR systems against the specific fixed releases below.
Six records cover Firefox ESR 153.7, while five also name Firefox ESR 115.45. CVE-2026-124900 is fixed only in Firefox 160, and CVE-2026-124917 does not list ESR 115.45.
Which Firefox 160 Sandbox Escape Fixes Apply?
The records identify boundary-condition errors in Graphics: Text and Storage: Cache API. They identify use-after-free flaws in cubeb, Service Workers, IPC, and the GTK widget component.
| CVE | Component | Fixed releases named in the record |
|---|---|---|
| CVE-2026-124853 | Graphics: Text | Firefox 160; ESR 115.45; ESR 153.7 |
| CVE-2026-124859 | Storage: Cache API | Firefox 160; ESR 115.45; ESR 153.7 |
| CVE-2026-124861 | Audio/Video: cubeb | Firefox 160; ESR 115.45; ESR 153.7 |
| CVE-2026-124864 | DOM: Service Workers | Firefox 160; ESR 115.45; ESR 153.7 |
| CVE-2026-124900 | DOM: Service Workers | Firefox 160 |
| CVE-2026-124903 | IPC | Firefox 160; ESR 115.45; ESR 153.7 |
| CVE-2026-124917 | Widget: GTK | Firefox 160; ESR 153.7 |
Each NVD record carries a secondary CVSS 3.1 score of 9.6, rated Critical. The shared vector requires user interaction and describes network reachability, low complexity, no privileges, and changed scope.
NVD lists CWE-120 for CVE-2026-124859 and CWE-416 for CVE-2026-124864, CVE-2026-124900, and CVE-2026-124903. The other three records do not provide a CWE, and none provides a CVSS 4.0 score.
Deploy the Firefox Fixes in This Order
- Inventory Firefox channelsSeparate standard Firefox, ESR 115, and ESR 153 installations before assigning updates.
- Deploy the matching releaseMove standard installations to Firefox 160 and supported ESR installations to the fixed release named for that branch.
- Handle exceptionsDo not treat ESR 115.45 as covering CVE-2026-124917 because its record names only Firefox 160 and ESR 153.7.
- Restart FirefoxClose and reopen the browser so the updated code replaces the running process.
- Verify active versionsConfirm the running version on managed endpoints and record systems that remain below the required release.
Use a documented patch management process to track rollout and restart status. A vulnerability management workflow can help owners prioritize browser installations that miss the first deployment window.
Do not infer coverage from the product family alone because the fixed-release lists differ. Check the exact Firefox channel and active version on each endpoint after deployment.
If endpoint evidence indicates suspicious browser activity, preserve relevant records and follow an incident response plan. The opened records do not identify attackers, targets, campaigns, or indicators.
What Can Security Teams Verify?
Teams can verify installed channels, running versions, restart completion, and exception ownership. These checks provide direct evidence that the applicable fixed code is active across the managed fleet.
The records were published on November 10, 2026, and NVD had not yet analyzed affected configurations. Recheck the primary records during remediation because record details may change after initial publication.
Frequently Asked Questions
Which version contains the Firefox 160 sandbox escape fixes?
Standard Firefox users should move to Firefox 160. The records also name Firefox ESR 115.45 or ESR 153.7 for specific CVEs.
Does Firefox ESR 115.45 cover all seven CVEs?
No. Five records name ESR 115.45. CVE-2026-124900 names only Firefox 160, while CVE-2026-124917 names Firefox 160 and ESR 153.7.
How should teams verify the Firefox update?
Confirm the installed channel and active version after restarting Firefox. Record an owner and follow-up date for every system below its required fixed release.
