{"id":"firefox-public-exploit-flaws-jul-2026","category":"patch","status":"closed","title":"Firefox fixes critical WebAssembly and site isolation flaws with public exploit code","tldr":"Firefox patched two critical flaws with public exploit code on 14 July; ESR and Thunderbird fixes followed on 21 July. Update affected browsers and Thunderbird. Mozilla reported no known attacks, and no later confirmation was found.","summary":"Mozilla released Firefox 152.0.6 on 14 July 2026 to fix two critical vulnerabilities: an invalid memory pointer in WebAssembly and a site isolation flaw in page navigation. Both had public exploit code, making prompt updating important for families and workplaces using affected Firefox versions. Mozilla said it was unaware of attacks exploiting either flaw. Fixes subsequently reached Firefox ESR 140.13 for both vulnerabilities, Firefox ESR 115.38 for the site isolation vulnerability, and Thunderbird 140.13 for both on 21 July. Mozilla cautioned that many Thunderbird flaws cannot be exploited through ordinary email reading because scripting is disabled, but browser-like contexts can present risks. Fixes are available for the affected branches identified in these advisories. As of 3 November, the sources reviewed provide no later confirmation of attacks exploiting these two flaws.","action":"Install the latest available Firefox update; the first fixes were Firefox 152.0.6, ESR 140.13 and ESR 115.38 for their respective branches. If you use Thunderbird's 140 branch, update to at least 140.13, preferably its latest available release. Ask your IT team to update managed work devices.","product":"Mozilla Firefox, Firefox ESR and Thunderbird 140","audience":"both","severity":"critical","patch":"patched","exploited":false,"cves":["CVE-2026-15718","CVE-2026-15719"],"tags":["mozilla","firefox","thunderbird","browser","webassembly","site-isolation"],"affected":["Firefox before 152.0.6","Firefox ESR 140 branch before 140.13: both CVEs","Firefox ESR 115 branch before 115.38: CVE-2026-15719","Thunderbird 140 branch before 140.13: both CVEs"],"fixed":["Firefox 152.0.6","Firefox ESR 140.13","Firefox ESR 115.38: CVE-2026-15719","Thunderbird 140.13"],"matches":[{"platform":"firefox","app":"Firefox","bundle":"","fixed":"152.0.6"},{"platform":"firefox","app":"Firefox ESR 140","bundle":"","fixed":"140.13"},{"platform":"firefox","app":"Firefox ESR 115","bundle":"","fixed":"115.38"},{"platform":"other","app":"Thunderbird 140","bundle":"","fixed":"140.13"}],"sources":[{"kind":"advisory","title":"Security Vulnerabilities fixed in Firefox 152.0.6","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/","by":"Mozilla","date":"2026-07-14"},{"kind":"advisory","title":"Security Vulnerabilities fixed in Firefox ESR 140.13","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/","by":"Mozilla","date":"2026-07-21"},{"kind":"advisory","title":"Security Vulnerabilities fixed in Firefox ESR 115.38","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-69/","by":"Mozilla","date":"2026-07-21"},{"kind":"advisory","title":"Security Vulnerabilities fixed in Thunderbird 140.13","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-72/","by":"Mozilla","date":"2026-07-21"},{"kind":"post","title":"Firefox 152.0.6 Release Notes","url":"https://www.firefox.com/en-US/firefox/152.0.6/releasenotes/","by":"Mozilla","date":"2026-07-14"},{"kind":"advisory","title":"High Threat Security Alert (A26-07-22): Multiple Vulnerabilities in FireFox","url":"https://www.govcert.gov.hk/en/alerts_detail.php?id=1962","by":"GovCERT.HK","date":"2026-07-15"},{"kind":"advisory","title":"Mozilla Products Multiple Vulnerabilities","url":"https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities_20260715","by":"HKCERT","date":"2026-07-15"}],"started":"2026-07-14","closed":"2026-07-21","created":"2026-11-03T20:53:45.748Z","updated":"2026-11-03T20:53:45.748Z","cve_notes":[{"cve":"CVE-2026-15718","name":"Invalid memory pointer in Firefox WebAssembly","what":"An invalid memory pointer in Mozilla's JavaScript WebAssembly component has public exploit code, although Mozilla's advisory does not explain the precise consequences an attacker could cause.","severity":"critical","cvss":0},{"cve":"CVE-2026-15719","name":"Site isolation flaw in Firefox page navigation","what":"A flaw in Mozilla's DOM navigation component could let an attacker bypass site isolation, the protection that keeps different websites separated.","severity":"critical","cvss":0}],"timeline":[{"at":"2026-07-21","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Thunderbird 140.13 also fixed both flaws. Mozilla noted that disabled scripting prevents many of the release's flaws from being exploited through ordinary email reading, although browser-like contexts may remain exposed.","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-72/","by":"Mozilla","patch":"patched"},{"at":"2026-07-21","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Firefox ESR 115.38 fixed CVE-2026-15719. Mozilla's advisory for this branch does not list CVE-2026-15718.","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-69/","by":"Mozilla","patch":"partial"},{"at":"2026-07-21","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Mozilla released fixes for both flaws in Firefox ESR 140.13. It continued to report public exploit code without known attacks.","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/","by":"Mozilla","patch":"partial"},{"at":"2026-07-15","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"GovCERT.HK urged immediate updating, warning that malicious web content could trigger the vulnerabilities. Its alert identified Firefox for Windows before 152.0.6.","url":"https://www.govcert.gov.hk/en/alerts_detail.php?id=1962","by":"GovCERT.HK","patch":null},{"at":"2026-07-14","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Mozilla disclosed two critical flaws, CVE-2026-15718 and CVE-2026-15719, fixed in Firefox 152.0.6. Exploit code was public for both, but Mozilla said it knew of no attacks using either.","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/","by":"Mozilla","patch":"partial"}],"url":"https://hard.fyi/live/firefox-public-exploit-flaws-jul-2026/","json":"https://hard.fyi/api/live?id=firefox-public-exploit-flaws-jul-2026"}