Firefox 152.0.6 fixes two critical flaws with public exploit code

Mozilla has released Firefox 152.0.6 with fixes for two critical vulnerabilities: CVE-2026-15718 in JavaScript/WebAssembly and CVE-2026-15719 in DOM navigation and site isolation. For both, the vendor confirms that exploit code is public. Mozilla also says it is not aware of attacks abusing either flaw in the wild.

Those statements are not contradictory. Public code lowers the technical barrier for additional attackers. No confirmed exploitation means only that the vendor currently lacks such evidence. For organisations, this is the point for a rapid, controlled update—not a reason to wait for the first KEV entry.

What Firefox 152.0.6 fixes

CVE	Component	Mozilla impact	Current evidence
CVE-2026-15718	JavaScript: WebAssembly	critical	public exploit, no known in-the-wild attacks
CVE-2026-15719	DOM: Navigation / site isolation	critical	public exploit, no known in-the-wild attacks

CVE-2026-15718 concerns an invalid pointer in WebAssembly handling. Memory errors inside a browser engine matter because untrusted web content is processed by code that interprets complex attacker-controlled input.

CVE-2026-15719 affects site isolation in the DOM navigation path. Isolation is intended to constrain one origin’s influence over another origin’s data and execution. A flaw at that boundary is significant precisely because browsers routinely present many mutually untrusted origins in one interface.

The public advisory does not describe a complete exploitation chain or every prerequisite. Avoid claiming consequences that the vendor has not confirmed. The critical rating, public code and ubiquity of browsers already justify urgent action.

The browser is part of the enterprise attack surface

Many organisations still treat browser updating as an end-user choice. That is a mistake. Firefox may run on administrator workstations, developer machines, lab systems, terminal servers and personal devices authorised to reach corporate resources.

Risk increases where the browser user has:

• active sessions to administrative consoles;
• access to source repositories, cloud platforms or financial systems;
• local tokens, certificates or SSH keys;
• permission to install software;
• an unmanaged device accepted by corporate services.

Priority should therefore not depend on installation count alone. One unpatched administrator workstation can be more consequential than a hundred kiosks in an isolated segment.

An update plan based on evidence

1. Measure the effective version

Collect inventory from MDM, EDR or software-management tooling. Distinguish installed files from the browser process currently running: a user may have new binaries on disk while an old session remains active.

2. Start with privileged profiles

Update administrators, IT teams, developers, SOC analysts and users handling payments or sensitive records first. Close the remainder of the fleet against a measurable SLA.

3. Enforce a restart

Downloading 152.0.6 does not always replace running vulnerable processes. Communicate and enforce an application restart deadline, then measure the active version again.

4. Include off-network devices

Machines on leave, BYOD and devices that rarely connect to the VPN commonly disappear from standard reports. Conditional access can restrict sensitive services from non-compliant endpoints.

Monitoring after public exploit release

There is no single universal IOC for a browser vulnerability. Concentrate on endpoint behaviour:

• crashes or unusual Firefox process restarts;
• child processes that the browser does not normally launch;
• executable files written to unusual locations;
• new tasks, services or persistence following a web session;
• outbound connections from browser processes to unknown domains;
• corporate-service sign-ins from a new device after an endpoint event.

A single crash does not prove exploitation. Correlating a crash, abnormal child process, new file and subsequent account activity produces a much stronger signal.

Closing the task properly

A defensible outcome is not “we emailed users to update”. The team should know:

1. the percentage of active devices running Firefox 152.0.6 or later;
2. the exception list, with owner and deadline;
3. how many privileged workstations remain non-compliant;
4. whether the browser process actually restarted;
5. whether endpoint monitoring covers the elevated-risk window.

The same method scales to other browsers: effective version, user-risk profile, telemetry coverage and enforced deadline. An IT security audit should verify that browser governance includes remote devices and privileged identities—not only office workstations.

Primary source: Mozilla Foundation Security Advisory 2026-67 — Firefox 152.0.6.