CVE-2026-15719Patch(mozilla / firefox)

MEDIUMCVSS 5.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch mozilla firefox systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

mozilla CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.mozilla.org/security/advisories/mfsa2026-67/

Other references

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
14 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 12 signals
Technical details provided in 8 signals
Peaked 4d ago at 6 mentions (2026-07-15); latest day: 1
14 total mentions across 5 days

Affected systems

Vendors

mozilla

Products

firefox

Deep dive

Activity timeline14 mentions / 5d

Signal classification4 categories

Patch

1178.6%

Exploit

17.1%

PoC

17.1%

General

17.1%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	6	Exploit1Patch5
2026-07-16	3	Patch3
2026-07-22	2	Patch2
2026-07-27	2	Patch1PoC1
2026-08-27	1	General1

Full discourse14 posts

Xavier Rivera@XavierRiveraX90d
Patch
Mozilla patches two critical Firefox flaws with public exploit code (CVE-2026-15718, CVE-2026-15719), no in-the-wild attacks yet. Same day: Chrome ships 15 fixes, Adobe patches 88 CVEs including a 9.9 ColdFusion RCE, Broadcom fixes a 9.8 VMware Avi Load Balancer auth bypass.
Post summary
Mozilla, Chrome, Adobe, and Broadcom issued patches for critical vulnerabilities—including Firefox flaws with publicly available exploit code—while no in-the-wild exploitation has yet been reported.
00011112
601 followersView on X
Beto Day@BetoDay78d
PoC
🚨 Alerta Crítica en Mozilla Firefox Se publicaron PoC para 2 vulnerabilidades críticas: ▫️ CVE-2026-15718: Ejecución de código (WebAssembly) ▫️ CVE-2026-15719: Bypass de Site Isolation 🛠️ Solución: Actualizar a v152.0.6 ya. #Ciberseguridad #Firefox #InfoSec #CyberAlert https://t.co/EW6xhNgF4b
Post summary
Critical Firefox vulnerabilities have been disclosed with PoCs and a patch advisory recommending update to v152.0.6.
0001077
200 followersView on X
kawn@kawn202084d
Patch
#securityupdate #mozilla #firefox ブラウザ Firefox ESR 140.13 リリース． CVE ベースで 32 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件．・CVE-2026-15718 ・CVE-2026-15719 4 段階中 2 番目の「high」 16 件． https://x.com/kawn2020/status/2079721501587345461
Post summary
Mozilla Firefox ESR 140.13 addresses 32 CVEs, including 2 critical and 16 high severity vulnerabilities, as part of the release update.
1000045
92 followersView on X
CyberTLDR@CyberTLDR89d
Patch
2/3: The Firefox bugs (CVE-2026-15718, CVE-2026-15719) have public exploit code but no confirmed attacks yet. Chrome patched two critical use after free flaws in Ozone that let attackers corrupt memory via a crafted page. Update to build 150.0.7871.125. #InfoSec #CVE #TechNews
Post summary
Firefox CVE‑2026‑15718 and CVE‑2026‑15719 have public exploit code but no attacks reported; Chrome has patched critical use‑after‑free flaws in Ozone with build 150.0.7871.125.
1000063
29 followersView on X
IntegSec@integ_sec47d
General
CVE-2026-15719: Firefox and Thunderbird Site Isolation Navigation Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04vwp-r0
Post summary
The provided text only lists a CVE identifier with a generic headline and a link, offering no concrete details on exploitation, patches, or technical aspects.
0000041
33 followersView on X
kawn@kawn202079d
Patch
#securityupdate #mozilla #thunderbird メールアプリ Thunderbird 140.13 リリース． CVE ベースで 33 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件．・CVE-2026-15718 ・CVE-2026-15719 4 段階中 2 番目の「high」 16 件． https://x.com/kawn2020/status/2081558738998301041
Post summary
The tweet announces the Thunderbird 140.13 release, noting it patches 33 CVEs, including two critical and 16 high‑severity ones.
0000056
92 followersView on X
kawn@kawn202084d
Patch
#securityupdate #mozilla #firefox ブラウザ Firefox ESR 115.38 リリース． CVE ベースで 14 件の脆弱性に対処． 4 段階中 1 番目の「critical」 1 件．・CVE-2026-15719 4 段階中 2 番目の「high」 11 件． https://x.com/kawn2020/status/2079725308585099361
Post summary
The tweet announces an update to Firefox ESR 115.38 that patches 14 CVEs, including a critical one, with no evidence of exploit activity or PoC.
0000061
92 followersView on X
kawn@kawn202090d
Patch
#securityupdate #mozilla #firefox ブラウザ Firefox 152.0.6 リリース． CVE ベースで 2 件の脆弱性に対処． 4 段階中 1 番目の「critical」 2 件．・CVE-2026-15718 ・CVE-2026-15719 https://x.com/kawn2020/status/2077681160361304073
Post summary
Firefox version 152.0.6 has been released to patch two critical CVE‑2026‑15718 and CVE‑2026‑15719 vulnerabilities.
0000052
90 followersView on X
Nikhil N@thecyberjim90d
Patch
Day 13 of posting cyber news everyday Mozilla patched two critical Firefox flaws (CVE-2026-15718, CVE-2026-15719) in v152.0.6 — one a bad WebAssembly pointer, the other a DOM site-isolation break. Exploit code is already public. Google fixed 15 Chrome bugs including two critical use-after-free issues in Ozone, Linux’s display layer, now patched in v150.0.7871.124/.125. Adobe pushed 88 fixes across ColdFusion, Commerce, Magento, and Experience Manager — eight in ColdFusion alone, topped by a 9.9 CVSS path traversal leading to code execution. Broadcom closed a 9.8 auth bypass in VMware Avi Load Balancer that let network-level attackers walk straight into the control plane, no credentials required. None confirmed exploited yet — but patch before that changes.
Post summary
The report informs that Mozilla, Google, Adobe, and Broadcom have issued patches for several critical CVEs, with public exploit code available for some, yet no confirmed active exploitation has been observed.
00000136
140 followersView on X
Security Arsenal, LLC@SecurityAr5840990d
Patch
🔒 #CyberSecurity CVE-2026-15718 & CVE-2026-15719: Firefox Critical Flaws with Public Exploit Cod… "Mozilla has released out-of-band security updates for Firefox addressing two critical…" 🔗 https://securityarsenal.com/blog/cve-2026-15718-and-cve-2026-15719-firefox-critical-flaws-with-public-exploit-code-defense-guide #CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday
Post summary
The post announces Mozilla’s out‑of‑band security updates for CVE‑2026‑15718 and CVE‑2026‑15719, mentions existing public exploit code, but provides no exploit details or evidence of active attacks.
0000077
18 followersView on X
Aviatrix Threat Research Center@aviatrixtrc90d
Exploit
TRC analysis shows attackers exploiting Firefox WebAssembly flaws (CVE-2026-15718, CVE-2026-15719) to achieve code execution and escalate privileges. With public exploit code available, threat actors can pivot through compromised browser sessions. Runtime segmentation helps limit lateral movement from browser-based compromise vectors. #ZeroDay 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/firefox-chrome-adobe-vmware-updates-fix-multiple-critical-security-flaws
Post summary
TRC analysis indicates attackers are exploiting newly disclosed Firefox WebAssembly vulnerabilities (CVE-2026-15718/15719) for code execution and privilege escalation, with public exploit code available, though no patch or detailed exploit code is provided.
0000072
1.9K followersView on X
Dexmond Technologies Ltd@Dexmond_Tech90d
Patch
News: Mozilla, Google, Adobe and VMware released updates addressing multiple critical vulnerabilities — notably Mozilla patched two Firefox flaws for which exploit code is publicly available: CVE-2026-15718 (invalid pointer in JavaScript: WebAssembly) and CVE-2026-15719 (site-isolation bypass in DOM: Navigation). With exploit code circulating, organisations face an elevated risk of remote compromise via browsers and embedded content. Immediate steps: - Prioritise and deploy vendor updates (browsers and plugins first); enable automatic updates where safe. - Apply compensating controls: network segmentation, web content filtering and tailored EDR detections for WebAssembly/DOM exploit patterns. - Hunt for indicators of compromise: review navigation anomalies, unexpected wasm execution and related telemetry. - If patching is delayed, consider virtual patching at gateways and stricter browsing policies. Expert take: public exploit code shortens the window between disclosure and active attacks. Browser and DOM flaws can be high-impact entry points that chain into broader breaches — treat these as active threats. Organisations with automated patch orchestration, staged rollouts and real-time telemetry will reduce exposure time and disruption. Dexmond can assist with CVE prioritisation, safe rollout planning and detection tuning across endpoints and networks. Patch, monitor and contain now.
Post summary
Mozilla and other vendors released patches for two critical Firefox CVEs with publicly available exploit code, urging rapid update and implementation of compensating controls to mitigate the elevated remote compromise risk.
0000056
40 followersView on X
Offensive Lab@OffensiveLab90d
Patch
Mozilla has released updates to address two critical flaws in #Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718, an invalid pointer in the JavaScript: WebAssembly component CVE-2026-15719, a site isolation in the DOM: Navigation component "We are aware that exploit code for this is public, however we are not aware of any attacks in the wild abusing this flaw," Mozilla said in an advisory. Both vulnerabilities have been addressed in Firefox version 152.0.6. The release comes as Google shipped fixes for 15 security flaws, including two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), a cross-platform abstraction layer that allows the browser to interact natively with various display servers and windowing systems. It supports Linux, ChromeOS, and Fuchsia.
Post summary
Mozilla released a patch for two critical Firefox vulnerabilities, noting public exploit code exists but no wild attacks have been observed, while also highlighting Google’s recent fixes for other critical bugs.
00000136
112 followersView on X
TECHEPAGES@techepages91d
Patch
🚨 Mozilla patches two critical Firefox flaws — and public exploit code already exists for both 🔹 CVE-2026-15718: invalid pointer bug in JavaScript WebAssembly component 🔹 CVE-2026-15719: site isolation flaw in DOM Navigation 🔹 Exploit code is public, but no in-the-wild attacks observed yet 🔹 Update to Firefox 152.0.6 now before attackers weaponize it
Post summary
Mozilla released patches for CVE-2026-15718 and CVE-2026-15719; public exploit code exists but no active attacks yet, urging users to upgrade to Firefox 152.0.6.
0000056
23 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	-	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-15719

Xavier Rivera[verified]@XavierRiveraXPatch

Mozilla, Chrome, Adobe, and Broadcom issued patches for critical vulnerabilities—including Firefox flaws with publicly available exploit code—while no in-the-wild exploitation has yet been reported.

IntegSec[verified]@integ_secGeneral

The provided text only lists a CVE identifier with a generic headline and a link, offering no concrete details on exploitation, patches, or technical aspects.

Nikhil N[verified]@thecyberjimPatch

The report informs that Mozilla, Google, Adobe, and Broadcom have issued patches for several critical CVEs, with public exploit code available for some, yet no confirmed active exploitation has been observed.

Security Arsenal, LLC[verified]@SecurityAr58409Patch

The post announces Mozilla’s out‑of‑band security updates for CVE‑2026‑15718 and CVE‑2026‑15719, mentions existing public exploit code, but provides no exploit details or evidence of active attacks.

Aviatrix Threat Research Center[verified]@aviatrixtrcExploit

TRC analysis indicates attackers are exploiting newly disclosed Firefox WebAssembly vulnerabilities (CVE-2026-15718/15719) for code execution and privilege escalation, with public exploit code available, though no patch or detailed exploit code is provided.

Dexmond Technologies Ltd[verified]@Dexmond_TechPatch

Mozilla and other vendors released patches for two critical Firefox CVEs with publicly available exploit code, urging rapid update and implementation of compensating controls to mitigate the elevated remote compromise risk.

Offensive Lab[verified]@OffensiveLabPatch

Mozilla released a patch for two critical Firefox vulnerabilities, noting public exploit code exists but no wild attacks have been observed, while also highlighting Google’s recent fixes for other critical bugs.

TECHEPAGES[verified]@techepagesPatch

Mozilla released patches for CVE-2026-15718 and CVE-2026-15719; public exploit code exists but no active attacks yet, urging users to upgrade to Firefox 152.0.6.