Loading vulnerability…
CVE-2026-15718 is a critical invalid-pointer vulnerability in Mozilla's JavaScript WebAssembly component affecting Firefox and Thunderbird. Mozilla reported that public exploit code is available, but had not observed exploitation in the wild. The available information does not identify the precise memory-safety root cause or vulnerable function.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a real exploit PoC for CVE-2026-15718, a SpiderMonkey WebAssembly baseline compiler miscompilation caused by a missing sync() before array.fill. Structure is compact and purpose-built: README.md explains root cause, affected versions, exploitation stages, and limitations; poc/gen_trigger.py generates a minimal trigger wasm and poc-min.js runner; poc/gen_chain.py hand-assembles a larger wasm module implementing exploitation primitives; poc/chain.tpl.js is the JavaScript harness template; poc/build.sh regenerates chain.js by embedding generated wasm bytes; poc/chain.js is the final full exploit; tools/xul_slots.py is an auxiliary offline Mach-O analysis helper. Main exploit capability is a staged browser/JS-engine exploitation chain. The minimal PoC demonstrates stale-slot reuse on the zero-trip array.fill path. The full chain uses paired 'plant' and 'read' wasm functions to create addrOf and fakeobj primitives, then constructs a fake WasmArrayObject to achieve arbitrary 64-bit read/write over the host process memory. With that primitive, the exploit leaks a JSFunction native pointer, scans backward in memory page-by-page for the Mach-O magic 0xfeedfacf to recover the XUL base, parses Mach-O load commands and symbol metadata at runtime, resolves the __stubs entry for _posix_spawnp without hardcoded offsets, forges a funcref object pointing at that stub, and invokes it via call_ref. The exploit is not a framework module and is not merely a detector. It contains an operational payload: spawning /bin/sh with '-c' and the command 'touch /tmp/CVE-2026-15718-PWNED'. The repository explicitly states the demonstrated chain is for macOS arm64 and an unsandboxed shell process; in a real Firefox content-process attack, a separate sandbox escape would still be required for full compromise. No network C2 or remote URLs are contacted by the exploit itself; the notable fingerprintable artifacts are local file paths, the XUL binary target, the _posix_spawnp symbol, and the created marker file.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability addressed by the Miracle Linux AXSA-2026-1698 advisory; no technical flaw details are provided.
Referenced as one of multiple vulnerabilities addressed by Miracle Linux AXSA-2026-1625 affecting Miracle Linux 9 Thunderbird package; no specific technical details are provided in the content.
A critical Firefox vulnerability described as an invalid pointer in the JavaScript: WebAssembly component.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.