VulnSocial

CVE-2026-15718Patch(mozilla / firefox)

HIGHCVSS 4.3 · MEDIUM

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

  • Patch mozilla firefox systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

mozilla CVEsBack to dashboard
7.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-763

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • firefox

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 14 mentions across 5 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 9 signals
  • Patch or workaround mentioned in 12 signals
  • Technical details provided in 9 signals
  • Peaked 4d ago at 6 mentions (2026-07-15); latest day: 1
  • 14 total mentions across 5 days

Affected systems

Vendors
mozilla
Products
firefox

Deep dive

Activity timeline14 mentions / 5d
02356Mentions · 2026-07-15: 6Mentions · 2026-07-16: 4Mentions · 2026-07-22: 1Mentions · 2026-07-27: 2Mentions · 2026-08-26: 1PoC Mentioned / Linked · 2026-07-15: 6PoC Mentioned / Linked · 2026-07-16: 2PoC Mentioned / Linked · 2026-07-27: 1Exploit Tool / Code · 2026-07-15: 1Exploit Tool / Code · 2026-07-16: 1Active Exploitation · 2026-07-15: 1Patch / Workaround · 2026-07-15: 5Patch / Workaround · 2026-07-16: 4Patch / Workaround · 2026-07-22: 1Patch / Workaround · 2026-07-27: 2Technical Details · 2026-07-15: 5Technical Details · 2026-07-16: 2Technical Details · 2026-07-27: 1Technical Details · 2026-08-26: 107-1507-1607-2207-2708-26
Signal classification4 categories
Patch
1071.4%
Exploit
214.3%
Active Exploitation
17.1%
Disclosure
17.1%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-156
Active Exploitation1Exploit1Patch4
2026-07-164
Exploit1Patch3
2026-07-221
Patch1
2026-07-272
Disclosure1Patch1
2026-08-261
Patch1
Full discourse14 posts
  • Xavier Rivera@XavierRiveraX
    Patch

    Mozilla patches two critical Firefox flaws with public exploit code (CVE-2026-15718, CVE-2026-15719), no in-the-wild attacks yet. Same day: Chrome ships 15 fixes, Adobe patches 88 CVEs including a 9.9 ColdFusion RCE, Broadcom fixes a 9.8 VMware Avi Load Balancer auth bypass.

    Post summary

    Mozilla, Chrome, Adobe, and Broadcom have released patches for multiple critical vulnerabilities; public exploit code exists for the Firefox flaws, but no wild exploitation has been reported yet.

    00011112
    601 followersView on X
  • Beto Day@BetoDay
    Disclosure

    🚨 Alerta Crítica en Mozilla Firefox Se publicaron PoC para 2 vulnerabilidades críticas: ▫️ CVE-2026-15718: Ejecución de código (WebAssembly) ▫️ CVE-2026-15719: Bypass de Site Isolation 🛠️ Solución: Actualizar a v152.0.6 ya. #Ciberseguridad #Firefox #InfoSec #CyberAlert https://t.co/EW6xhNgF4b

    Post summary

    The tweet announces critical Firefox vulnerabilities, highlights published proofs of concept, provides concise technical descriptors, and urges updating to patch v152.0.6.

    0001077
    200 followersView on X
  • kawn@kawn2020
    Patch

    #securityupdate #mozilla #firefox ブラウザ Firefox ESR 140.13 リリース． CVE ベースで 32 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件． ・CVE-2026-15718 ・CVE-2026-15719 4 段階中 2 番目の「high」 16 件． https://x.com/kawn2020/status/2079721501587345461

    Post summary

    Firefox ESR 140.13 release patches 32 CVEs, including two critical ones (CVE‑2026‑15718 and CVE‑2026‑15719), providing a focused security update without mention of PoCs, exploits, or active attacks.

    1000045
    92 followersView on X
  • CyberTLDR@CyberTLDR
    Patch

    2/3: The Firefox bugs (CVE-2026-15718, CVE-2026-15719) have public exploit code but no confirmed attacks yet. Chrome patched two critical use after free flaws in Ozone that let attackers corrupt memory via a crafted page. Update to build 150.0.7871.125. #InfoSec #CVE #TechNews

    Post summary

    Firefox bugs have public exploit code but no attacks verified yet; Chrome has patched critical use‑after‑free flaws in Ozone and released an update.

    1000063
    29 followersView on X
  • CiT-CSIRT@CitCsirt
    Patch

    2026. 7.14 Mozilla Foundation Security Advisory 2026-67 Security Vulnerabilities fixed in Firefox 152.0.6 [Mozilla] https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/#CVE-2026-15718

    Post summary

    Mozilla’s advisory announces that CVE‑2026‑15718 has been fixed in Firefox 152.0.6, providing a patch for the identified vulnerability.

    1000049
    89 followersView on X
  • IntegSec@integ_sec
    Patch

    CVE-2026-15718: Mozilla Firefox WebAssembly Invalid Pointer Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04vsLgF0

    Post summary

    The article outlines the business implications of CVE‑2026‑15718 and presumably offers remediation guidance, but does not provide exploit details or evidence of active exploitation.

    0000035
    33 followersView on X
  • kawn@kawn2020
    Patch

    #securityupdate #mozilla #thunderbird メールアプリ Thunderbird 140.13 リリース． CVE ベースで 33 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件． ・CVE-2026-15718 ・CVE-2026-15719 4 段階中 2 番目の「high」 16 件． https://x.com/kawn2020/status/2081558738998301041

    Post summary

    Mozilla Thunderbird 140.13 announces a patch release fixing 33 CVEs, including two critical ones (CVE-2026-15718 and CVE-2026-15719).

    0000056
    92 followersView on X
  • kawn@kawn2020
    Patch

    #securityupdate #mozilla #firefox ブラウザ Firefox 152.0.6 リリース． CVE ベースで 2 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件． ・CVE-2026-15718 ・CVE-2026-15719 https://x.com/kawn2020/status/2077681160361304073

    Post summary

    Firefox 152.0.6 includes patches for two critical CVEs, CVE‑2026‑15718 and CVE‑2026‑15719, as part of its security update.

    0000052
    90 followersView on X
  • Nikhil N@thecyberjim
    Exploit

    Day 13 of posting cyber news everyday Mozilla patched two critical Firefox flaws (CVE-2026-15718, CVE-2026-15719) in v152.0.6 — one a bad WebAssembly pointer, the other a DOM site-isolation break. Exploit code is already public. Google fixed 15 Chrome bugs including two critical use-after-free issues in Ozone, Linux’s display layer, now patched in v150.0.7871.124/.125. Adobe pushed 88 fixes across ColdFusion, Commerce, Magento, and Experience Manager — eight in ColdFusion alone, topped by a 9.9 CVSS path traversal leading to code execution. Broadcom closed a 9.8 auth bypass in VMware Avi Load Balancer that let network-level attackers walk straight into the control plane, no credentials required. None confirmed exploited yet — but patch before that changes.

    Post summary

    Mozilla, Google, Adobe, and Broadcom have released patches for new critical CVEs, with exploit code already available for Mozilla’s issues, though no active exploitation has been reported yet.

    00000136
    140 followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    Exploit

    🔒 #CyberSecurity CVE-2026-15718 & CVE-2026-15719: Firefox Critical Flaws with Public Exploit Cod… "Mozilla has released out-of-band security updates for Firefox addressing two critical…" 🔗 https://securityarsenal.com/blog/cve-2026-15718-and-cve-2026-15719-firefox-critical-flaws-with-public-exploit-code-defense-guide #CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday

    Post summary

    The post announces critical Firefox flaws, highlights available public exploit code, and notes that Mozilla has issued out‑of‑band patches to fix them.

    0000077
    18 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting Firefox WebAssembly flaws (CVE-2026-15718, CVE-2026-15719) to achieve code execution and escalate privileges. With public exploit code available, threat actors can pivot through compromised browser sessions. Runtime segmentation helps limit lateral movement from browser-based compromise vectors. #ZeroDay 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/firefox-chrome-adobe-vmware-updates-fix-multiple-critical-security-flaws

    Post summary

    Attackers have used publicly available exploit code to target Firefox WebAssembly CVEs (CVE‑2026‑15718 and CVE‑2026‑15719), achieving code execution and privilege escalation.

    0000072
    1.9K followersView on X
  • Dexmond Technologies Ltd@Dexmond_Tech
    Patch

    News: Mozilla, Google, Adobe and VMware released updates addressing multiple critical vulnerabilities — notably Mozilla patched two Firefox flaws for which exploit code is publicly available: CVE-2026-15718 (invalid pointer in JavaScript: WebAssembly) and CVE-2026-15719 (site-isolation bypass in DOM: Navigation). With exploit code circulating, organisations face an elevated risk of remote compromise via browsers and embedded content. Immediate steps: - Prioritise and deploy vendor updates (browsers and plugins first); enable automatic updates where safe. - Apply compensating controls: network segmentation, web content filtering and tailored EDR detections for WebAssembly/DOM exploit patterns. - Hunt for indicators of compromise: review navigation anomalies, unexpected wasm execution and related telemetry. - If patching is delayed, consider virtual patching at gateways and stricter browsing policies. Expert take: public exploit code shortens the window between disclosure and active attacks. Browser and DOM flaws can be high-impact entry points that chain into broader breaches — treat these as active threats. Organisations with automated patch orchestration, staged rollouts and real-time telemetry will reduce exposure time and disruption. Dexmond can assist with CVE prioritisation, safe rollout planning and detection tuning across endpoints and networks. Patch, monitor and contain now.

    Post summary

    Mozilla released patches for two critical Firefox vulnerabilities; public exploit code exists, so organizations should promptly apply vendor updates and implement compensating controls.

    0000056
    40 followersView on X
  • Offensive Lab@OffensiveLab
    Patch

    Mozilla has released updates to address two critical flaws in #Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718, an invalid pointer in the JavaScript: WebAssembly component CVE-2026-15719, a site isolation in the DOM: Navigation component "We are aware that exploit code for this is public, however we are not aware of any attacks in the wild abusing this flaw," Mozilla said in an advisory. Both vulnerabilities have been addressed in Firefox version 152.0.6. The release comes as Google shipped fixes for 15 security flaws, including two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), a cross-platform abstraction layer that allows the browser to interact natively with various display servers and windowing systems. It supports Linux, ChromeOS, and Fuchsia.

    Post summary

    Mozilla has patched two critical Firefox vulnerabilities for which exploit code is publicly available, but reports no known wild attacks.

    00000136
    112 followersView on X
  • TECHEPAGES@techepages
    Patch

    🚨 Mozilla patches two critical Firefox flaws — and public exploit code already exists for both 🔹 CVE-2026-15718: invalid pointer bug in JavaScript WebAssembly component 🔹 CVE-2026-15719: site isolation flaw in DOM Navigation 🔹 Exploit code is public, but no in-the-wild attacks observed yet 🔹 Update to Firefox 152.0.6 now before attackers weaponize it

    Post summary

    Mozilla released patches for two critical Firefox CVEs, with public exploit code available but no evidence of active exploitation yet.

    0000056
    23 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmozillafirefox---

Explore more

Back to dashboardmozilla CVEsfirefox vulnerabilities