Firefox Rushes Out Fix After Attack Code for Two Critical Bugs Appears Online
Mozilla says working exploit code is already public for two serious flaws in its browser. Users should update now.
Key points
- Mozilla patched two critical Firefox flaws, CVE-2026-15718 and CVE-2026-15719, after working attack code appeared in public.
- The first bug sits in the browser's JavaScript/WebAssembly engine; the second breaks the safety wall that keeps websites isolated from each other.
- Mozilla says it hasn't seen either flaw used against real users yet, but public exploit code shortens that window fast.
- Firefox users on desktop should update immediately through the browser's built-in updater.
Mozila has pushed out an emergency update for Firefox after admitting that ready-made attack code for two critical flaws is already circulating online. The fix landed this week. Mozilla's own advisory is blunt: "We are aware that exploit code for this is public."
That matters. Public exploit code means any competent attacker can copy it, adapt it and use it against Firefox users without needing to find the bugs themselves.
What exactly did Mozilla fix?
Two separate flaws, both rated critical.
The first is CVE-2026-15718, an invalid pointer bug inside Firefox's JavaScript/WebAssembly engine. WebAssembly, usually written as Wasm, lets websites run fast, near-native code inside your browser: think in-browser video editors or CAD tools. An invalid pointer is when the program tries to use a memory address that doesn't point where it should. Attackers can often twist that mistake into a way to run their own code on your machine.
The second is CVE-2026-15719, a site isolation failure in Firefox's DOM navigation component. Site isolation is the safety wall that stops one website from reading data belonging to another site you have open. When that wall cracks, a malicious page can potentially snoop on tabs it should never see. The browser-as-attack-surface angle isn't new: our 6 July story on an Opera GX bug that let any website silently install a data-stealing add-on showed how quickly that class of flaw gets weaponised.
Mozilla says it isn't aware of either flaw being used against real people yet. That qualifier tends to age quickly once exploit code is loose.
Should ordinary Firefox users be worried?
Worried, no. Prompt, yes.
Critical browser bugs with public exploit code are the classic case where the gap between patch and mass exploitation is measured in days, sometimes hours. On desktop, open Firefox, click the menu, then Help, then About Firefox. The browser checks for updates and installs them itself. Restart when asked. That's the entire job.
Mobile Firefox users should update through their app store as soon as the new version appears there.
Who is on the hook if something goes wrong?
Firefox is made by the Mozilla Foundation, a US non-profit. No single regulator oversees browser security the way the FTC oversees consumer data practices or the ICO oversees UK personal data. But if a compromised browser leads to a company data breach, the usual rules apply: the FTC in the US, the ICO in the UK, and equivalents like the OAIC in Australia will expect the breached company, not Mozilla, to notify affected people.
A browser bug is rarely just a browser bug once it lands inside a corporate laptop.
What affected users should do
Update Firefox today, on every device you use it on. If you manage a fleet of machines, push the new version through your update tooling rather than trusting each user to click through.
Public exploit code gets bolted onto phishing campaigns fast. If you use Firefox for anything sensitive, banking or work email, treat the next week as reason to be a little more suspicious of odd links than usual.
