CVE-2026-15718: Mozilla Firefox WebAssembly Invalid Pointer Dereference

HERMES

HERMES THREAT SCORE & WEAPONIZED WASM EXPLOIT PROFILE

Target: Mozilla Firefox WebAssembly Runtime Engine (Cranelift / Baseline)

Confidence: 99%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 20 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2026-15718 at Critical threat (HTS 92). The availability of functional public weaponized exploit code combined with WebAssembly's low-level hardware memory abstraction renders this vulnerability highly dangerous for unpatched browsers.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-15718: Mozilla Firefox WebAssembly Invalid Pointer DereferenceVULNERABILITY

Connected Nodes: 0

Weaponized WebAssembly Invalid Pointer Flaw

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-824: Access of Uninitialized Pointer.
Confirmed Public Exploit Tooling Available. An invalid memory pointer flaw in Firefox’s WebAssembly execution pipeline allows malicious web pages embedding crafted Wasm binaries to execute arbitrary code within the sandboxed content process. Fixed in Firefox 152.0.6 and Firefox ESR 140.13.

---

1. Metadata & Remediation

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-15718	Standardized vulnerability identifier
Affected Engine	JavaScript / WebAssembly	In-browser binary code execution
Fixed Releases	Firefox 152.0.6, Firefox ESR 140.13	Out-of-band security patch
Associated CWE	CWE-824: Uninitialized Pointer Access	Memory safety corruption
Public Exploit	Yes (Weaponized PoC Available)	Imminent exploitation threat

1. Apply Urgent Update: Deploy Firefox 152.0.6 or Firefox ESR 140.13.
2. WebAssembly Policy: Disable WebAssembly if required in ultra-secure environments via javascript.options.wasm = false.