CVE-2026-15719: Mozilla Firefox Site Isolation Bypass via DOM Navigation

HERMES

HERMES THREAT SCORE & SITE ISOLATION COLLAPSE

Target: Mozilla Firefox DOM Navigation & Fission Site Isolation Architecture

Confidence: 98%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 18 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2026-15719 at High threat (HTS 88). Fission site isolation ensures each web origin operates in a dedicated OS process. Breaking cross-origin window boundaries permits hostile tabs to inspect or manipulate authenticated sessions in neighboring tabs.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-15719: Mozilla Firefox Site Isolation Bypass via DOM NavigationVULNERABILITY

Connected Nodes: 0

Site Isolation Boundary Bypass

CVSS v3.1: 8.3 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) / CWE-693: Protection Mechanism Failure.
Public Exploit Proof-of-Concept Available. A race condition in cross-origin DOM navigation allows an attacker-controlled origin to maintain an unauthorized reference to a separate origin’s window context, bypassing process-level site isolation. Fixed in Firefox 152.0.6 and Firefox ESR 140.13.

---

1. Metadata & Remediation

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-15719	Standardized vulnerability identifier
Affected Subsystem	DOM: Navigation / Fission	Process-level site isolation
Fixed Releases	Firefox 152.0.6, Firefox ESR 140.13	Security update
Associated CWE	CWE-693: Protection Mechanism Failure	Cross-origin boundary violation

1. Apply Firmware/Browser Patch: Upgrade to Firefox 152.0.6 or Firefox ESR 140.13.
2. Verify Fission Status: Ensure fission.autostart = true in enterprise deployments.