Patch Day: Mozilla Confirms Public Exploits for Firefox as Adobe…

On July 15, 2026, four vendors released critical updates simultaneously. Mozilla broke with standard practice by explicitly confirming public exploit code exists for both vulnerabilities patched in Firefox 152.0.6, while Chrome fixed 15 flaws including two critical Ozone use-after-free bugs, Adobe closed 88 vulnerabilities with scores up to CVSS 9.9, and VMware addressed a CVSS 9.8 authentication bypass in Avi Load Balancer discovered by the NATO Cyber Security Centre. No vendor reported active exploitation at time of disclosure.

On July 15, 2026, Mozilla, Google, Adobe, and Broadcom/VMware simultaneously released critical security updates for Firefox, Chrome, ColdFusion, Experience Manager, and Avi Load Balancer. Mozilla explicitly confirmed that public exploit code already exists for both vulnerabilities fixed in Firefox 152.0.6 — a disclosure that breaks the standard vendor practice of declining to comment on weaponization status. Chrome patched 15 flaws including two critical use-after-free bugs in the Ozone layer, while Adobe closed 88 vulnerabilities with peaks at CVSS 9.9 and VMware fixed a CVSS 9.8 authentication bypass. None of the vendors reported active attacks at the time of disclosure.

The temporal concentration and the disparity in philosophy — Mozilla's candor versus Google's narrative control, which restricts technical details until the rollout completes — create a particularly compressed patching week for enterprise teams.

Key Takeaways

Mozilla released Firefox 152.0.6 on July 15, 2026, fixing two critical vulnerabilities, CVE-2026-15718 and CVE-2026-15719, for which public exploit code exists according to the vendor's official confirmation.
Google shipped Chrome 150.0.7871.124 (Linux) and 150.0.7871.125 (Windows/macOS) with 15 fixes, including two critical use-after-free vulnerabilities in the Ozone subsystem (CVE-2026-15764 and CVE-2026-15765) that operate at the trust boundary with the operating system, outside the renderer sandbox.
Adobe published updates for 88 vulnerabilities: eight in ColdFusion with CVSS scores ranging from 9.0 to 9.9, two in Experience Manager at CVSS 9.6, and two in Commerce/Magento Open Source up to 9.6.
VMware fixed CVE-2026-47865 (CVSS 9.8) in Avi Load Balancer, an authentication bypass discovered by a researcher at the NATO Cyber Security Centre that allows an attacker with network access to reach the Control Plane.

Mozilla's Rare Admission: Public Exploits Declared Without Confirmed Attacks

Mozilla included in its advisory MFSA 2026-67 a formulation vendors rarely use: We are aware that exploit code for this is public, however we are not aware of any attacks in the wild abusing this flaw, as cited by The Hacker News, TechTimes, SecurityWeek, and Malwarebytes. The first part establishes an objective fact — the code is available — while the second bounds the risk: at the time of disclosure, no active exploitation was known.

CVE-2026-15718 is classified as an invalid pointer in the JavaScript: WebAssembly component, with a CVSS 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) according to the NVD record. CVE-2026-15719 is a site isolation issue in DOM: Navigation, with CVSS 5.4 MEDIUM. Both are rated Critical in Mozilla's internal classification despite the moderate NVD scores: the gap between NVD technical severity and vendor priority reflects the different weight assigned to the availability of working exploits.

The decision to publicly declare the existence of exploits is functionally opposite to Google's approach for Chrome, which maintains its established regime of embargoing technical details until the majority of users have received the update via the Omaha infrastructure. Mozilla exposes the risk in plain sight; Google manages it by distributing it.

Ozone: Why Chrome's Two Criticals Deserve Attention Beyond the NVD Score

The two critical Chrome vulnerabilities, CVE-2026-15764 and CVE-2026-15765, are use-after-free bugs in the Ozone subsystem, Chrome's display abstraction that unifies rendering across platforms (Linux, ChromeOS, Wayland, X11). According to NVD records, both carry CVSS 7.5 HIGH with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H and are marked Chromium security severity: Critical.

"Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page"
— NIST National Vulnerability Database, CVE-2026-15764

Ozone's architectural position is the reason for the elevated internal severity. Ozone sits outside Chrome's renderer process sandbox, at the trust boundary with the operating system. A use-after-free in this layer offers a more direct path to sandbox escape compared to an equivalent bug confined to the renderer, where Chrome's process model isolates most damage. TechTimes highlighted this distinction as the element explaining why Google classifies these as Critical flaws with NVD scores that aggregators might read as HIGH.

A documented limitation in the dossier: the NVD descriptions for CVE-2026-15764 and CVE-2026-15765 show a minimal variation. CVE-2026-15764 specifies on Linux, while CVE-2026-15765 reads in Google Chrome without platform restriction. If the second form indicates broader scope, exposure increases significantly; the dossier does not clarify whether the difference is intentional or an artifact of textual extraction from the NVD.

Adobe: 88 Vulnerabilities and the Density of CVSS 9+ in Network-Exposed Products

Adobe released updates on July 15, 2026, for 88 vulnerabilities distributed across multiple products. ColdFusion concentrates eight critical issues with scores ranging from CVSS 9.0 to 9.9, all with RCE or privilege escalation impact. According to the official advisory APSB26-82, CVE-2026-48318 (path traversal → RCE) scores 9.9, followed by CVE-2026-48322 (code injection → RCE) and CVE-2026-48284 (improper input validation → RCE), both at 9.6. The official patches are ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22, with Priority 1.

Adobe Experience Manager adds CVE-2026-48259 (SSRF → RCE) and CVE-2026-48359 (XXE → RCE), both at CVSS 9.6 per advisory APSB26-74. Adobe Commerce/Magento Open Source includes CVE-2026-48356 (file upload → privilege escalation, CVSS 9.6) and CVE-2026-48358 (improper encoding/escaping → RCE, CVSS 9.1). The deployment profile of these products — web-facing servers, often network-accessible for business functionality — amplifies the impact compared to client-side vulnerabilities requiring user interaction.

VMware Avi Load Balancer: The NATO Cyber Security Centre Discovery

The most severe fix in the Broadcom/VMware portfolio is CVE-2026-47865, an authentication bypass with CVSS 9.8 in Avi Load Balancer. The primary source attributes discovery to Filip Waeytens of the NATO Cyber Security Centre (NCSC), a rare instance of explicit institutional attribution in a vendor advisory. The vulnerability allows an attacker with network access to reach the Avi Load Balancer's Control Plane without valid authentication. Avi is an infrastructure component typically positioned in network segments requiring availability and visibility: the combination of network accessibility and absent authentication barriers makes the flaw particularly sensitive for enterprise environments, even in the absence of observed exploitation at the time of disclosure.

Immediate Actions

Verify deployment of Firefox 152.0.6 on all endpoints: the public availability of exploits for CVE-2026-15718 and CVE-2026-15719 compresses the weaponization timeline to days, not weeks.
Force a manual Chrome update via Settings → About Google Chrome to bypass the gradual Omaha rollout, given that the two critical Ozone flaws (CVE-2026-15764, CVE-2026-15765) strike a layer at the sandbox boundary.
Apply Adobe ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22 with Priority 1, treating the eight critical vulnerabilities rated CVSS 9.0–9.9 as exposed infrastructure releases.
Isolate or immediately update VMware Avi Load Balancer instances, verifying that the Control Plane is not reachable from unauthorized network segments pending deployment of the fix.

The July 15 Lesson: Two Disclosure Ethics in Collision

The simultaneity of the July 15, 2026 updates juxtaposes two risk communication models that produce opposite effects on defenders. Mozilla, by declaring the existence of public exploits, gives security teams actionable intelligence but increases emotional and operational pressure. Google, by obscuring technical details during the gradual rollout, protects unpatched users but leaves enterprise defenders engaging with a threat that is not fully characterized.

Mozilla's choice is statistically rare: vendors and security coordinators tend to avoid explicit mention of public exploits unless detection is unavoidable or the disclosure responsibility is external. Whether this signals a change in practice or an isolated case depends on the next advisory cycles. For now, the only certainty is that July 15, 2026 produced a Patch Day with four vendors, zero confirmed active exploitation, and an information asymmetry that enterprise teams must manage without filters.

Information verified against cited sources and current as of publication.

Sources

Sources and references