NewsCompaniesFlawsGuides
Get the app
CriticalFixedClosedUpdated

Firefox fixes critical WebAssembly and site isolation flaws with public exploit code

Firefox patched two critical flaws with public exploit code on 14 July; ESR and Thunderbird fixes followed on 21 July. Update affected browsers and Thunderbird. Mozilla reported no known attacks, and no later confirmation was found.

What to do

Install the latest available Firefox update; the first fixes were Firefox 152.0.6, ESR 140.13 and ESR 115.38 for their respective branches. If you use Thunderbird's 140 branch, update to at least 140.13, preferably its latest available release. Ask your IT team to update managed work devices.

Check your devices
  • Firefoxfixed in 152.0.6 and later
  • Firefox ESR 140fixed in 140.13 and later
  • Firefox ESR 115fixed in 115.38 and later
  • Thunderbird 140fixed in 140.13 and later

What’s happening

Mozilla released Firefox 152.0.6 on 14 July 2026 to fix two critical vulnerabilities: an invalid memory pointer in WebAssembly and a site isolation flaw in page navigation. Both had public exploit code, making prompt updating important for families and workplaces using affected Firefox versions. Mozilla said it was unaware of attacks exploiting either flaw. Fixes subsequently reached Firefox ESR 140.13 for both vulnerabilities, Firefox ESR 115.38 for the site isolation vulnerability, and Thunderbird 140.13 for both on 21 July. Mozilla cautioned that many Thunderbird flaws cannot be exploited through ordinary email reading because scripting is disabled, but browser-like contexts can present risks. Fixes are available for the affected branches identified in these advisories. As of 3 November, the sources reviewed provide no later confirmation of attacks exploiting these two flaws.

What
Flaw
Affects
Mozilla Firefox, Firefox ESR and Thunderbird 140
Affected
Firefox before 152.0.6
Firefox ESR 140 branch before 140.13: both CVEs
Firefox ESR 115 branch before 115.38: CVE-2026-15719
Thunderbird 140 branch before 140.13: both CVEs
Fixed in
Firefox 152.0.6
Firefox ESR 140.13
Firefox ESR 115.38: CVE-2026-15719
Thunderbird 140.13
CVE
CVE-2026-15718, CVE-2026-15719
Since
14 July 2026
Closed
21 July 2026

Timeline

  1. New fixFixed

    Thunderbird 140.13 also fixed both flaws. Mozilla noted that disabled scripting prevents many of the release's flaws from being exploited through ordinary email reading, although browser-like contexts may remain exposed.

  2. New fixPartly fixed

    Firefox ESR 115.38 fixed CVE-2026-15719. Mozilla's advisory for this branch does not list CVE-2026-15718.

  3. New fixPartly fixed

    Mozilla released fixes for both flaws in Firefox ESR 140.13. It continued to report public exploit code without known attacks.

  4. Update

    GovCERT.HK urged immediate updating, warning that malicious web content could trigger the vulnerabilities. Its alert identified Firefox for Windows before 152.0.6.

  5. Made publicPartly fixed

    Mozilla disclosed two critical flaws, CVE-2026-15718 and CVE-2026-15719, fixed in Firefox 152.0.6. Exploit code was public for both, but Mozilla said it knew of no attacks using either.

Sources

  1. Security Vulnerabilities fixed in Firefox 152.0.6Mozilla · 14 July 2026
  2. Security Vulnerabilities fixed in Firefox ESR 140.13Mozilla · 21 July 2026
  3. Security Vulnerabilities fixed in Firefox ESR 115.38Mozilla · 21 July 2026
  4. Security Vulnerabilities fixed in Thunderbird 140.13Mozilla · 21 July 2026
  5. Firefox 152.0.6 Release NotesMozilla · 14 July 2026
  6. High Threat Security Alert (A26-07-22): Multiple Vulnerabilities in FireFoxGovCERT.HK · 15 July 2026
  7. Mozilla Products Multiple VulnerabilitiesHKCERT · 15 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS