CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Mozilla Firefox DOM Navigation site-isolation bypass (public exploit code, no confirmed ITW); fixed 152.0.6

cve · CVE-2026-15719

Coverage
1
first 2026-07-17 → last 2026-07-17
Latest activity
2026-07-17
Mozilla patches a WebAssembly memory bug and a site-isolation bypass in Firefox 152.0.6; exploit code is…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-15719, newest first. Check the date before acting on an older one.

  • Expedite the Firefox 152.0.6 update across managed and Firefox-ESR desktop fleets rather than waiting on the normal auto-update cadence, public exploit code for the CVE-2026-15718/-15719 chain raises the exploitation window now, even though no in-the-wild abuse is yet confirmed.
    2026-07-17CVE-2026-15718 +1

Defender insights

What each entry about CVE-2026-15719 tells a defender to do, newest first.

2026-07-17NOTABLEMozilla patches a WebAssembly memory bug and a site-isolation bypass in Firefox 152.0.6; exploit code is public, no confirmed in-the-wild abuse

Story timeline

  1. 2026-07-17Firefox 152.0.6, chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)
    trending-vulnerabilitiesMozilla patches a WebAssembly memory bug and a site-isolation bypass in Firefox 152.0.6; exploit code is public, no confirmed in-the-wild abuse

Hunting pivots

Affected products
Mozilla Firefox
Tags
patch-availablepoc-publicrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessDrive-by Compromise
  • ExecutionExploitation for Client Execution

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-07-17/firefox-152-0-6-wasm-site-isolation-public-exploit · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-07-17/firefox-152-0-6-wasm-site-isolation-public-exploit · ATT&CK page ↗

Entries about Mozilla Firefox DOM Navigation site-isolation bypass (public exploit code, no confirmed ITW); fixed 152.0.6 (1)

2026-07-17 · view entry permalink →

NOTABLECVE-2026-15718 +1NATOA2

Firefox 152.0.6, chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)

Mozilla released Firefox 152.0.6 on 2026-07-14 to fix two flaws NCSC-NL flagged on 2026-07-16 specifically because exploit code is public, which raises the likelihood of abuse (NCSC-NL, 2026-07-16). CVE-2026-15718 is an invalid-pointer memory-safety bug in the JavaScript engine's WebAssembly component; CVE-2026-15719 is a site-isolation bypass in the DOM Navigation component (Mozilla, 2026-07-14). The pairing matches the classic browser-exploit shape where a site-isolation bypass turns a memory-safety bug into cross-origin/sandbox-relevant code execution, needing only that a victim load a malicious page or a legitimate page serving a malicious ad. Severity ratings diverge across the primaries: Mozilla labels both flaws "Critical" impact, while NCSC-NL's CSAF record scores them CVSS 3.1 MEDIUM (CVE-2026-15718 base 4.3, CVE-2026-15719 base 5.4); the individual base scores are moderate, and the operational concern is the chained code-execution potential plus the public exploit code, not a high CVSS. Crucially, Mozilla's own advisory text for both CVEs is explicit: "we are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw", so the accurate status is public PoC, not confirmed exploitation, and the "zero-day exploited in attacks" framing carried by at least one vulnerability-scanner blog overstates the primary source.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

Mozilla Foundation Security Advisory mfsa2026-67

Mozilla geeft aan dat exploitcode voor de kwetsbaarheden publiek beschikbaar is. Dit vergroot de kans op misbruik.

NCSC-NL (NCSC-2026-0242)
vulnerability17 Jul 04:35Zmulti-sourceOpen finding →
Sources: Mozilla Foundation Security Advisory · NCSC-NL

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisories.ncsc.nl1 (50%)
  • mozilla.org1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)