Mozilla released Firefox 152.0.6 on Tuesday to patch two critical browser vulnerabilities after exploit code capable of targeting the flaws became publicly available.
The company said it is not aware of either vulnerability being exploited in attacks. The vulnerabilities, tracked as CVE-2026-15718 and CVE-2026-15719, affect Firefox through version 152.0.5. Mozilla rates both critical and lists Firefox 152.0.6 as the fixed release.
Updates are pushed to the Firefox browser, however users can force a check by opening the browser menu, selecting Help and then About Firefox. The browser will download the update and prompt the user to restart if necessary.
Invalid Memory Pointer in WebAssembly
Mozilla’s security bulletin lists one of the vulnerabilities, CVE-2026-15718, as an invalid memory pointer in WebAssembly flaw in Firefox’s JavaScript WebAssembly component.
The WebAssembly component allows websites to run compiled applications, such as games, graphics programs, video tools and other demanding software, inside the browser at speeds approximating conventional desktop applications.
To provide that performance, Firefox must validate, compile and manage relatively low-level code supplied by a website. The browser also uses pointers, which act like addresses telling it where information is stored in memory.
An invalid-pointer flaw means Firefox could be induced to use an address that is incorrect, no longer valid or points to memory the browser should not access. Specially crafted web content could potentially trigger memory corruption, crash the browser or interfere with information held in memory.
Mozilla has not published enough technical detail to determine precisely what an attacker could accomplish with CVE-2026-15718.
Site Isolation Under Threat
The second vulnerability, CVE-2026-15719, affects site isolation in Firefox’s DOM navigation component.
The Document Object Model, or DOM, is the browser’s internal representation of a webpage. It converts the page’s HTML into a structured collection of objects representing its text, forms, buttons, images and embedded content.
Firefox’s navigation system must update those objects whenever a tab, page or embedded frame moves from one document or website to another. At the same time, site isolation attempts to place unrelated websites into separate browser processes so that code running on one site cannot easily reach information belonging to another.
An example is a shopper who clicks a payment button on an online store. That triggers communication from the browser to a bank’s authentication page and redirected back to the online store. Behind the scenes, Firefox must replace the webpage’s DOM, determine which site owns the new document and place it into the correct isolated process.
A vulnerability in that handoff could potentially confuse which site or process controls a document, allowing content to retain access across a boundary that should have been closed.
That type of flaw is particularly concerning when chained with another browser vulnerability. One exploit might give an attacker control inside a restricted webpage process, while a site-isolation flaw could help the attacker cross a defensive boundary intended to contain the initial compromise.
Mozilla has not disclosed the exact mechanics of CVE-2026-15719, so it is not yet clear whether the flaw can independently expose cross-site data or whether it is primarily useful as part of a larger exploit chain.
Best practices when installing an updating is to restart the browser after updating it to ensure the security fixes have been applied.
