Loading vulnerability…
Site isolation flaw in Firefox and Thunderbird DOM Navigation
CVE-2026-15719 is a site isolation vulnerability in the DOM: Navigation component of Mozilla Firefox and Thunderbird. The flaw compromises site isolation enforcement during DOM navigation. Public exploit code is available, although Mozilla stated that it was not aware of attacks exploiting the vulnerability in the wild. Fixes were released in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can undermine site isolation in the DOM: Navigation component. The precise effects on confidentiality, integrity, and availability are not established for this vulnerability; arbitrary code execution and other impacts attributed to bundled security updates cannot be attributed specifically to this CVE.
If you can’t patch tonight, do this now.
No specific temporary workaround is documented. Apply the relevant security update.
Patch, then assume compromise.
Upgrade to Firefox 152.0.6 or later, Firefox ESR 115.38 or later on the 115 ESR branch, Firefox ESR 140.13 or later on the 140 ESR branch, or Thunderbird 140.13 or later. On Debian 13 (trixie), install firefox-esr 140.13.0esr-1~deb13u1 or later and thunderbird 1:140.13.0esr-2~deb13u1 or later, as applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.