In short: On 14 July 2026 Mozilla released Firefox 152.0.6, fixing two critical vulnerabilities — CVE-2026-15718 and CVE-2026-15719. The first is in WebAssembly; the second breaks "site isolation" (Fission), the barrier that stops one tab from reading another tab's data. Working exploit code is already public, though Mozilla has seen no attacks in the wild. What to do: update your browser to 152.0.6 (or later) on every device right away.
What happened?
On 14 July 2026 Mozilla published security advisory MFSA2026-67 and shipped Firefox 152.0.6, patching two vulnerabilities rated "critical." For both, exploit code is publicly available — a ready-made example showing how the flaw can be abused. Mozilla says it is not aware of any real-world attacks yet, but a public exploit sharply raises the risk: attackers no longer have to work out how to strike, because the method is already written down.
For everyday users the takeaway is simple: the browser is your main window onto the internet, carrying passwords, banking sessions and private messages, so its security directly affects the privacy of your data. We cover how to build defence in depth on our blog.
What is "site isolation" and why is bypassing it dangerous?
The more worrying of the two is CVE-2026-15719 in the DOM: Navigation component. It affects Fission — the "site isolation" architecture enabled by default in Firefox since version 95. Fission's idea is that every open website runs in its own operating-system process. That is a key privacy barrier: if a malicious page in one tab compromises its own process, isolation stops it from reaching the contents of another tab — say, your online bank or email open next to it.
CVE-2026-15719 lets an attacker cross that barrier: a compromised renderer process can reach data in a different tab's process. The second flaw, CVE-2026-15718, is an invalid-pointer bug in the JavaScript: WebAssembly component; this class of memory error is the one attackers most reliably turn into code execution. Together they describe a dangerous scenario in which a single malicious page potentially threatens everything open in the browser.
Why is this dangerous for your data?
A browser-based attack targets the most sensitive things you type and view online: passwords, card numbers, private messages, banking sessions. Tab isolation exists precisely so that a malicious site you stumble upon cannot peek into a neighbouring tab. When that barrier can be bypassed and exploit code is public, the window of opportunity for attackers widens — especially for anyone who does not update promptly.
Let us be honest about one limit: a VPN by itself does not close a browser vulnerability — only an update fixes a flaw in the code. But a VPN protects a different, equally important layer: once your data leaves for the network, especially on open Wi-Fi, encryption keeps it from being intercepted in transit and hides your real IP. We looked at that network risk in our report on data theft on public Wi-Fi. Digital safety works in layers — updates, strong passwords and network encryption complement each other, and no single layer is a silver bullet.
How to protect yourself?
Update Firefox right now. Install version 152.0.6 or later. Open the menu → Help → About Firefox: the browser will check for and download the update, then click Restart. Check every device, Android included.
Do not postpone the restart. The update only takes effect once the browser restarts — Firefox usually restores your tabs.
Turn on automatic updates. In Firefox settings (General → Firefox Updates) choose to install updates automatically so future patches arrive without your involvement.
Keep the network layer covered. On other people's and open networks, use a VPN so your traffic travels through an encrypted tunnel and your real IP stays hidden. LiMP VPN is a no-logs service for iOS and Android — see the features and plans.
Sources
This report is based on the Mozilla security advisory (MFSA2026-67) and coverage by The Hacker News and Qualys ThreatPROTECT (July 2026).