Firefox DOM Navigation site-isolation flaw with public exploit code
A site-isolation flaw in Firefox's DOM Navigation component. Mozilla notes exploit code is public but no in-the-wild attacks are confirmed. Fixed in Firefox 152.0.6.
- Vendor
- Mozilla
- Product
- Firefox (pre-152.0.6)
- CVSS
- 5.4
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-15719 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-15719 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
CVE-2026-15719 is a site-isolation flaw in the DOM Navigation component of Firefox. Mozilla’s advisory carries the same disclosure as the sibling CVE-2026-15718: “We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.” NVD scores it 5.4 (medium). The urgency is the exploit-code status, not the base score.
The fix ships in Firefox 152.0.6. See the Mozilla Foundation Security Advisories index for the corresponding MFSA and confirm managed Firefox instances have relaunched into the patched build.
Full coverage: Firefox exploit code public; Chrome, Adobe patch same day.
Other Mozilla Firefox CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-15718 Firefox JavaScript/WebAssembly invalid pointer with public exploit codewrite-up | [ MEDIUM ] | 4.3 | 0.5% | — |
| CVE-2026-10702 JIT miscompilation in Firefox JavaScript engine allows renderer code executionwrite-up | [ MEDIUM ] | 4.3 | 0.9% | — |
| CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 23.2% | |
| CVE-2015-4495 Mozilla Firefox Security Feature Bypass Vulnerability | [ HIGH ] | 8.8 | 68.6% | |
| CVE-2022-26486 Mozilla Firefox Use-After-Free Vulnerability | [ CRITICAL ] | 9.6 | 2.4% | |
| CVE-2022-26485 Mozilla Firefox Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 14.3% | |
| CVE-2013-1675 Mozilla Firefox Information Disclosure Vulnerability | [ MEDIUM ] | 6.5 | 6.7% |
