---
schema: 1
kind: vulnerability
title: "Firefox 152.0.6 — chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)"
headline: "Mozilla patches a WebAssembly memory bug and a site-isolation bypass in Firefox 152.0.6 — exploit code is public, no confirmed in-the-wild abuse"
summary: >
  Mozilla shipped Firefox 152.0.6 on 2026-07-14 fixing two critical-impact flaws that NCSC-NL flagged fresh on
  2026-07-16 because exploit code is public: CVE-2026-15718 is an invalid-pointer memory-safety bug in the
  WebAssembly engine and CVE-2026-15719 is a site-isolation bypass in the DOM Navigation component; combined they
  point to a browser code-execution chain triggered by visiting a malicious or malicious-ad-serving page. Mozilla
  states it is not aware of any in-the-wild attacks — contrary to some aggregator "zero-day exploited" framing.
  Relevant to any managed desktop or Firefox-ESR fleet, including government workstations.
discovered_at: "2026-07-17T04:35:00Z"
event_date: "2026-07-16"
run_id: 2026-07-17T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, poc-public, patch-available]
regions: [global]
sectors: [public-sector]
entities: []
techniques: [T1189, T1203]
affected_products: ["Mozilla Firefox"]
cves:
  - id: CVE-2026-15718
    cvss: "4.3"
    epss: null
    type: memory-corruption
    vector: user-interaction
    auth: pre-auth
    status: [poc-public, patch-available]
    affected: "Firefox 152.x below 152.0.6"
    fixed: "152.0.6"
  - id: CVE-2026-15719
    cvss: "5.4"
    epss: null
    type: logic-flaw
    vector: user-interaction
    auth: pre-auth
    status: [poc-public, patch-available]
    affected: "Firefox 152.x below 152.0.6"
    fixed: "152.0.6"
sources:
  - url: "https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/"
    publisher: "Mozilla Foundation Security Advisory"
    date: "2026-07-14"
    role: primary
  - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0242"
    publisher: "NCSC-NL"
    date: "2026-07-16"
    role: primary
closed_sources: []
evidence:
  - quote: "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw."
    publisher: "Mozilla Foundation Security Advisory mfsa2026-67"
  - quote: "Mozilla geeft aan dat exploitcode voor de kwetsbaarheden publiek beschikbaar is. Dit vergroot de kans op misbruik."
    publisher: "NCSC-NL (NCSC-2026-0242)"
verification: multi-source
sourcing_note: "Severity ratings diverge across the two primaries and both are recorded: Mozilla assigns no numeric CVSS but rates both CVEs advisory impact 'Critical', while NCSC-NL's CSAF record scores them CVSS 3.1 MEDIUM (CVE-2026-15718 base 4.3; CVE-2026-15719 base 5.4) — the cvss field carries the NCSC-NL base scores. The load-bearing status per Mozilla's own text is that exploit code is public with no confirmed in-the-wild exploitation; at least one aggregator (Qualys ThreatPROTECT) headlined this as an exploited zero-day, which contradicts the primary source and is not carried here. NCSC-NL corroborates the public-exploit-code fact."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Expedite the Firefox 152.0.6 update across managed and Firefox-ESR desktop fleets rather than waiting on the normal auto-update cadence — public exploit code for the CVE-2026-15718/-15719 chain raises the exploitation window now, even though no in-the-wild abuse is yet confirmed."
migrated_from: null
---

Mozilla released Firefox 152.0.6 on 2026-07-14 to fix two flaws NCSC-NL flagged on 2026-07-16 specifically because exploit code is public, which raises the likelihood of abuse ([NCSC-NL, 2026-07-16](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0242)). CVE-2026-15718 is an invalid-pointer memory-safety bug in the JavaScript engine's WebAssembly component; CVE-2026-15719 is a site-isolation bypass in the DOM Navigation component ([Mozilla, 2026-07-14](https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/)). The pairing matches the classic browser-exploit shape where a site-isolation bypass turns a memory-safety bug into cross-origin/sandbox-relevant code execution, needing only that a victim load a malicious page or a legitimate page serving a malicious ad. Severity ratings diverge across the primaries: Mozilla labels both flaws "Critical" impact, while NCSC-NL's CSAF record scores them CVSS 3.1 MEDIUM (CVE-2026-15718 base 4.3, CVE-2026-15719 base 5.4) — the individual base scores are moderate, and the operational concern is the chained code-execution potential plus the public exploit code, not a high CVSS. Crucially, Mozilla's own advisory text for both CVEs is explicit: "we are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw" — so the accurate status is public PoC, not confirmed exploitation, and the "zero-day exploited in attacks" framing carried by at least one vulnerability-scanner blog overstates the primary source.

**Defender takeaway:** there is no public technical root-cause write-up yet, so detection content is thin — the only generic hunt surface is browser-process telemetry (EDR alerts on Firefox crashes preceded by anomalous WebAssembly compilation or unusual cross-origin navigation sequences), and that is low-fidelity. The high-confidence control is the update itself: 152.0.6 closes both, and a browser restart completes it. Managed and ESR fleets that gate browser updates through change management are the population that stays exposed after the fix is available, so the operational task is expediting that rollout, not building a detection.