Firefox JavaScript/WebAssembly invalid pointer with public exploit code
An invalid-pointer flaw in Firefox's JavaScript / WebAssembly component. Mozilla notes exploit code is public but no in-the-wild attacks are confirmed. Fixed in Firefox 152.0.6.
- Vendor
- Mozilla
- Product
- Firefox (pre-152.0.6)
- CVSS
- 4.3
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-15718 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-15718 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
CVE-2026-15718 is an invalid-pointer bug in Firefox’s JavaScript / WebAssembly component. Mozilla’s advisory carries the notable language “We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.” NVD scores the bug 4.3 (medium) — Mozilla’s warning about public exploit code is what warrants the patch urgency, not the base score.
The fix ships in Firefox 152.0.6. Managed Firefox deployments should be force-relaunched — Firefox does not swap the running process to the patched build until the browser restarts, and users routinely leave it open for weeks. See the Mozilla Foundation Security Advisories index for the corresponding MFSA.
Full coverage of this and the concurrent Chrome and Adobe releases: Firefox exploit code public; Chrome, Adobe patch same day.
Other Mozilla Firefox CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-15719 Firefox DOM Navigation site-isolation flaw with public exploit codewrite-up | [ MEDIUM ] | 5.4 | 0.3% | — |
| CVE-2026-10702 JIT miscompilation in Firefox JavaScript engine allows renderer code executionwrite-up | [ MEDIUM ] | 4.3 | 0.9% | — |
| CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 23.2% | |
| CVE-2015-4495 Mozilla Firefox Security Feature Bypass Vulnerability | [ HIGH ] | 8.8 | 68.6% | |
| CVE-2022-26486 Mozilla Firefox Use-After-Free Vulnerability | [ CRITICAL ] | 9.6 | 2.4% | |
| CVE-2022-26485 Mozilla Firefox Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 14.3% | |
| CVE-2013-1675 Mozilla Firefox Information Disclosure Vulnerability | [ MEDIUM ] | 6.5 | 6.7% |
