Firefox 160 Patches a 9.6 Sandbox Escape

Mozilla published Firefox 160 on November 10, 2026, with a fix for CVE-2026-124853, a sandbox escape in the browser’s Graphics: Text component. The CVE record describes the flaw as “incorrect boundary conditions” and lists fixed builds for Firefox, Firefox ESR, and Thunderbird. CISA’s ADP enrichment scores it 9.6, critical, while Mozilla’s own advisory rates the impact high.

The bug is not in CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code is tracked. That makes it a patch-now vulnerability rather than a known zero-day. The distinction matters for triage, not for the update itself: a sandbox escape is the kind of bug an attacker chains with a renderer exploit, and the fixed builds are already available.

Key Takeaways:

• Mozilla fixed CVE-2026-124853 in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
• CISA’s ADP scores it CVSS 9.6 critical; Mozilla rates the impact high. The CVE record itself does not carry a vendor CVSS score.
• The flaw is a sandbox escape in Graphics: Text. Mozilla’s bug is access-restricted, so the advisory does not describe the memory-safety primitive.
• CISA SSVC lists exploitation as none and automatable as no. The CVE is not in KEV as of November 11, 2026.
• Firefox 160 also fixes six more sandbox escapes in the same release, covering the Cache API, cubeb audio, Service Workers, IPC, and GTK.

What Mozilla fixed

Mozilla Foundation Security Advisory 2026-125 covers Firefox 160 and lists CVE-2026-124853 as a sandbox escape due to incorrect boundary conditions in the Graphics: Text component. The same CVE appears in the ESR and Thunderbird advisories (MFSA 2026-126, 2026-127, 2026-128, and 2026-129): Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7 all contain the fix.

The CVE record was published on November 10, 2026, the same day as the advisories. Its affected-product table lists Firefox 115.45, 153.7, and 160 as unaffected, and Thunderbird 153.7 and 160 as unaffected. Mozilla does not publish a clean “all versions below X are affected” range in the record, so the fixed versions are the reliable comparison point. If a build is older than the branch’s fixed release, treat it as exposed until the distributor says otherwise.

The underlying Bugzilla entry, 2058035, is access-restricted. The public advisory names the component and the class of defect but not the exact out-of-bounds condition. That is normal for a security fix: the patch is shipped before the technical details are opened. It also means any claim about the precise trigger, the object affected, or a proof-of-concept is speculation unless it comes from Mozilla or the reporter.

Inside the Content-Process Boundary

Firefox runs web content in a sandboxed content process. The sandbox is the boundary between code that renders a page and the rest of the machine. A renderer bug that corrupts memory can crash that process; a sandbox escape turns the same kind of corruption into code execution outside the boundary. That is why a browser sandbox escape is rated more severely than a renderer crash even when both start with a memory-safety defect.

The Graphics: Text component handles text layout and glyph rendering, which processes font data and shaping instructions derived from page content. Mozilla’s description places the defect in that path. The advisory does not say whether the boundary error is an out-of-bounds read, an out-of-bounds write, or a different condition, so the exact primitive remains unknown. What is public is the consequence: an attacker who can reach the bug can cross the sandbox boundary.

The CVSS vector supplies the rest of the attacker model. It is network-reachable, low-complexity, requires no privileges, and requires user interaction. In practice, that is the shape of a malicious page or a crafted font or text payload that a user opens. The scope change is the part that captures the sandbox escape: the vulnerable component and the impacted component are different security authorities.

The 9.6 Score and Exploitation Status

The 9.6 comes from CISA’s ADP enrichment, not from Mozilla’s advisory. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Read it as a network attack with low complexity, no privileges, and one user action. Confidentiality, integrity, and availability impacts are all high, and the scope is changed because the escape crosses from the content process to a more privileged context.

Mozilla’s “high” rating and CISA’s “critical” score are not contradictory. Mozilla’s advisory impact ratings are a vendor severity scale; CVSS is a separate scoring system, and the 9.6 is an ADP contribution rather than a CNA score. The CVE record’s Mozilla container does not include a CVSS metric. Cite the source when using the number: “CISA ADP scores it 9.6” is accurate; “Mozilla rates it 9.6” is not.

No known exploitation is the other half of the triage. CISA’s SSVC entry lists exploitation as none, automatable as no, and technical impact as total. The CVE is not in KEV as of November 11, 2026, and cve.now tracks no public exploit code. That does not prove nobody has used it. It does mean the public record does not support a “zero-day” or “actively exploited” headline.

The rest of the Firefox 160 sandbox fixes

CVE-2026-124853 is not the only sandbox escape in Firefox 160. The same advisory carries six more, and Mozilla groups them with the Graphics: Text bug. Each is scored 9.6 by CISA’s ADP, and each is fixed in Firefox 160. The ESR and Thunderbird branches pick up most of them, with two gaps in the table: CVE-2026-124900 is absent from the ESR advisories, and CVE-2026-124917 is absent from ESR 115.45.

Two entries need a distinction. CVE-2026-124864 and CVE-2026-124900 both sit in DOM: Service Workers and both describe a use-after-free, but they reference different Mozilla bugs, 2075976 and 2083116. They are separate fixes, not a duplicate row. The GTK entry is also Linux-specific in practice; Mozilla’s CVE record still lists Firefox and Thunderbird generally, but the component name points at the Linux widget toolkit path.

The spread is the useful signal. The escapes are not concentrated in one subsystem: text rendering, the Cache API, audio, workers, IPC, and GTK all produced a sandbox boundary failure in the same cycle. That is a reminder that a browser sandbox is only as strong as every component that parses untrusted data inside it.

Who needs to update

Firefox users need version 160 or later. ESR users need 115.45 or 153.7, depending on the branch. Thunderbird users need 160 or 153.7. The main CVE is fixed in all five builds, so the branch choice does not change the answer for CVE-2026-124853; it only changes which advisory applies to the other six sandbox escapes.

Linux distributions often backport the fix without changing the upstream version number. A package that reports “Firefox 128” may still contain the patch, and a package that reports “Firefox 160” may be a snap or Flatpak build with a different release cadence. Check the distributor’s advisory and the package build date, not just the major version string. The same caution applies to managed ESR deployments: 115.45 and 153.7 are the fixed ESR builds, and the branch-specific advisories are MFSA 2026-126 and MFSA 2026-127.

Thunderbird’s advisory includes a scope note: many of the flaws cannot be exploited through email because scripting is disabled when reading mail, but they may pose risks in browser or browser-like contexts. That scope note still leaves the update as the right action. Treat the mail client as part of the browser attack surface, especially when it renders remote content or opens links in an embedded context.

How to check and patch

On Firefox, open the menu, choose Help, then About Firefox. The dialog shows the installed version and starts the update check. On Thunderbird, use Help, then About Thunderbird. On Linux, also check the package source: apt list --installed firefox, dnf info firefox, or flatpak info org.mozilla.firefox will show whether the build comes from the distribution, a snap, or Flatpak. Restart the application after the update; a running process can keep the old binary in memory.

For a fleet, inventory the actual browser and mail-client versions on endpoints, not the version declared in a software catalog. Compare against 160 for Firefox and Thunderbird, 115.45 for ESR 115, and 153.7 for ESR 153. If a host cannot be updated immediately, record it as exposed and track it against the CVE. There is no documented configuration switch that mitigates a sandbox escape, so “disable feature X” is not a substitute for the fixed build.

The patching priority is high but not emergency-level under the public record: no KEV listing, no public exploit, and a user-interaction requirement. The calculation changes if a renderer exploit for the same Firefox version appears, because the sandbox escape is the second stage of a chain. That is the scenario the fix is designed to close.

Bottom line

CVE-2026-124853 is a critical-scored sandbox escape in Firefox’s text rendering path, fixed in Firefox 160 and the current ESR and Thunderbird branches. Mozilla rates the impact high; CISA’s ADP scores it 9.6; the CVE is not in KEV and has no tracked public exploit. Firefox 160 also closes six more sandbox escapes in the same release. The practical action is the same for all of them: verify the build, update, restart, and check the branch-specific advisory for the ESR or Thunderbird installation.

Sources and References

• Mozilla Foundation Security Advisory 2026-125: Security Vulnerabilities fixed in Firefox 160
• Mozilla Foundation Security Advisory 2026-126: Firefox ESR 115.45
• Mozilla Foundation Security Advisory 2026-127: Firefox ESR 153.7
• Mozilla Foundation Security Advisory 2026-128: Thunderbird 160
• Mozilla Foundation Security Advisory 2026-129: Thunderbird 153.7
• CVE-2026-124853 record (MITRE CVE Services)
• cve.now entry for CVE-2026-124853
• CISA Known Exploited Vulnerabilities catalog