CVE-2026-15719
Mozilla FirefoxVulnerabilityCVSS 5.4PatchedPoC
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.
A public proof-of-concept or exploit code is available, raising the risk of active exploitation. A fixed version is available (see the table below).
Recommended action: Update to the fixed version listed for your distribution using the native package manager.
Severity metrics
CVSS 3.1 : 5.4 MEDIUM
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactLow
Integrity impactLow
Availability impactNone
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
| Distribution | Package | Affected | Fixed version | Status |
|---|---|---|---|---|
| Debian:11 | firefox-esr | - | 140.13.0esr-1~deb11u1 | fixed |
| Debian:12 | firefox-esr | - | 140.13.0esr-1~deb12u1 | fixed |
| Debian:13 | firefox-esr | - | 140.13.0esr-1~deb13u1 | fixed |
| Debian:14 | firefox-esr | - | 140.13.0esr-1 | fixed |
| Debian:11 | thunderbird | - | - | affected (no fix yet) |
| Debian:12 | thunderbird | - | - | affected (no fix yet) |
| Debian:13 | thunderbird | - | - | affected (no fix yet) |
| Debian:14 | thunderbird | - | - | affected (no fix yet) |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| openSUSE:Tumbleweed | MozillaFirefox | - | 152.0.6-1.1 | fixed |
| openSUSE:Tumbleweed | MozillaThunderbird | - | 140.13.0-1.1 | fixed |
| openSUSE:Tumbleweed | firefox-esr | - | 140.13.0-1.1 | fixed |