Loading vulnerability…
Invalid pointer in Firefox and Thunderbird JavaScript WebAssembly
CVE-2026-15718 is an invalid-pointer memory-safety vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird. It was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. Public exploit code exists, but Mozilla stated that it was not aware of attacks exploiting this flaw in the wild at the time of disclosure. The precise pointer-handling defect and exploitation mechanism are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation could compromise affected Firefox users through an invalid-pointer memory-safety flaw. The specific confidentiality, integrity, and availability consequences are not established for this CVE. Broader advisories describe arbitrary code execution and other consequences across multiple vulnerabilities, without attributing those outcomes specifically to CVE-2026-15718.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround is documented. Apply the available security updates.
Patch, then assume compromise.
Upgrade to Firefox 152.0.6 or later, Firefox ESR 140.13 or later, or Thunderbird 140.13 or later on the applicable maintained release branch. On Debian 13 (trixie), upgrade firefox-esr to 140.13.0esr-1~deb13u1 or later and thunderbird to 1:140.13.0esr-2~deb13u1 or later through security updates.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.