Unscored CVE-2026-124923 EUVD-2026-120933GHSA-2f94-x79r-94p2

Sandbox escape in the Agent component

Published Nov 10, 2026 · Updated Nov 10, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Thunderbird Package: mozjs102 Package: mozjs115 Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Package: thunderbird Category: Browsers Ecosystem: Ubuntu

Description

Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Affected products

Vendor	Product	Affected	Fixed
Mozilla	Firefox	—	160
Mozilla	Thunderbird	—	160

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	mozjs102 +1	No fix yet	—
Ubuntu 22.04 LTS	mozjs78 +3	No fix yet	—
Ubuntu 20.04 LTS	mozjs52 +1	No fix yet	—
Ubuntu 18.04 LTS	mozjs38 +1	No fix yet	—

Advisories 1

WID-SEC-2026-4515 Mozilla Firefox und Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026