Multi-vendor patch day: public exploit for Firefox, four…

Mozilla confirms public exploit code for two Firefox flaws. Google, Adobe, and VMware ship critical patches on July 15, 2026. No active exploitation confirmed, but the window between public PoC and mass weaponization is the real risk.

On July 15, 2026, Mozilla released Firefox 152.0.6 with a wake-up call: exploit code for two critical vulnerabilities is already public. In the same hours, Google shipped Chrome 150.0.7871.125 for two use-after-free bugs in the Ozone layer, Adobe patched 88 vulnerabilities — 8 critical in ColdFusion — and Broadcom issued advisory VMSA-2026-0005 for VMware Avi Load Balancer. No active exploitation was confirmed at the time of disclosure. The stakes are not an ongoing attack, but the speed at which a public proof-of-concept turns into a mass campaign.

Key takeaways

Mozilla confirms public exploit code is available for CVE-2026-15718 and CVE-2026-15719 in Firefox, though no in-the-wild exploitation has been reported.
Google patched two use-after-free flaws in Ozone, Chrome's display abstraction layer, with CVE-2026-15764 and CVE-2026-15765, both rated CVSS 7.5 HIGH by NVD.
Advisory APSB26-82 from Adobe addresses 8 critical ColdFusion vulnerabilities, including CVE-2026-48318 at CVSS 9.9 for path traversal leading to arbitrary code execution.
Broadcom VMSA-2026-0005 fixes CVE-2026-47865 at CVSS 9.8, an authentication bypass in the Avi Load Balancer control plane, discovered by Filip Waeytens for NATO NCSC.

Firefox: the exploit exists, the trigger not yet

The two Mozilla vulnerabilities mark a rare distinction in the current threat landscape: exploit code circulates, but no attacks have been detected. Mozilla Foundation Security Advisory MFSA 2026-67, cited by TechTimes and The Hacker News, states verbatim: "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw".

CVE-2026-15718 is an invalid pointer bug in Firefox's JavaScript/WebAssembly component. CVE-2026-15719 is a site isolation vulnerability in the DOM navigation component. Both lead to memory corruption and sandbox bypass, but carry CVSS scores of only 4.3 and 5.4 respectively per official records — scores that do not reflect the real-world criticality given public exploit availability.

The operational problem is immediate: Firefox requires a manual restart to apply the update. Users who keep tabs and sessions open leave a vulnerable version running even after the binary downloads. The gap between patch delivery and actual application creates a risk window no release date alone can measure.

Chrome and the gradual rollout problem

Google shipped Chrome 150.0.7871.124 for Linux and .125 for Windows/Mac with 15 security fixes. Two affect Ozone, the cross-platform abstraction layer that handles communication with display servers and windowing systems — X11, Wayland, DRM/KMS, ChromeOS, Fuchsia — and therefore sits at the boundary between browser and operating system.

Per NVD records, CVE-2026-15764 and CVE-2026-15765 are both use-after-free flaws rated CVSS 7.5 HIGH. The NVD description for CVE-2026-15764 specifies "on Linux," while CVE-2026-15765 does not repeat the qualifier — a detail that leaves the attack surface for Windows and Mac uncertain. Both require specific UI interaction and a crafted HTML page to trigger heap corruption.

Distribution via the Omaha updater occurs in fractions of the user base. Chrome holds nearly 71% of the desktop browser market per TechTimes: a gradual rollout on that installed base means tens of millions of vulnerable installations for days, even without confirmed active exploitation. The average user does not force the update; often they do not even know one exists.

Enterprise in the crosshairs: ColdFusion and Avi Load Balancer

Adobe Security Bulletin APSB26-82 documents 8 critical ColdFusion vulnerabilities with CVSS ranging from 9.0 to 9.9. CVE-2026-48318, the most severe at 9.9, is a path traversal leading to arbitrary code execution. Fixed versions are ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. The priority rating is 1, the highest on Adobe's scale, and the advisory explicitly confirms no in-the-wild exploits.

The Broadcom advisory VMSA-2026-0005 is equally blunt. CVE-2026-47865 carries CVSS 9.8 and allows a user with network access to bypass authentication in the Avi Load Balancer control plane. Discovery is credited to Filip Waeytens, NATO NCSC. The advisory lists 7 total vulnerabilities — one critical and 6 important — and explicitly states: no workaround available. Remediation requires upgrade to fixed versions.

The concentration of these patches in a single mid-July cycle stresses organizational patching capacity. Enterprise teams must simultaneously manage browser updates for distributed users, legacy development platforms like ColdFusion, and infrastructure components like virtualized load balancers.

"A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism." — Broadcom VMSA-2026-0005, CVE-2026-47865

What to do now

Firefox users must close the browser and restart to activate version 152.0.6. Automatic download is not enough. Chrome users can force the update by visiting chrome://settings/help and verifying build 150.0.7871.124/.125 before the automatic rollout completes.

ColdFusion administrators must apply the update to the supported version — 2025 Update 11 or 2023 Update 22 — with Adobe's priority rating 1 indicating production deployment within 72 hours. For VMware Avi Load Balancer, VMSA-2026-0005 offers no workaround: upgrading to a fixed version is the only documented option.

Security teams should monitor telemetry for anomalies in Firefox's JavaScript/WebAssembly and DOM navigation components, and in Avi Control Plane authentication logs. Public exploit availability for Firefox makes verification of existing control coverage a priority.

The window between PoC and weaponization

The July 15, 2026 pattern raises a timing question. When exploit code is public but not yet attacked, the risk is not zero — it is indeterminate. Threat landscape history shows mass weaponization often follows PoC publication by hours or days, not weeks. User behavior — the missing restart, the unforced update — artificially extends that window.

The difference between Firefox and Chrome is instructive: same technical severity, different exposure window due to distribution mechanism. Mozilla requires explicit user action; Google delays it automatically. Both approaches have flaws. The lesson is that browser security is no longer measured solely by vendor patch time, but by actual application time on the endpoint.

For enterprise infrastructure, the CVSS 9.8-9.9 of ColdFusion and Avi Load Balancer indicates intrinsic severity, not attack probability. But without confirmed active exploitation, security teams must balance urgency and resources. The risk is that the absence of "ongoing attack" gets read as "distant risk" — a reading the existence of public exploit code for Firefox makes hard to sustain.

Frequently asked questions

Why did Mozilla issue an advisory with relatively low CVSS scores if the exploit is public?
The CVSS 4.3 and 5.4 scores reflect the calculated attack vector and impact, not exploit availability or real-world risk. Operational criticality exceeds the theoretical score when exploit code is already accessible.

Is Chrome on Linux at greater risk than other platforms for the Ozone CVEs?
The NVD record for CVE-2026-15764 explicitly specifies "on Linux," while CVE-2026-15765 does not include the qualifier. This discrepancy between the two records leaves the attack surface for Windows and Mac uncertain.

Does no active exploitation mean I can delay patching?
No. The absence of active exploitation at disclosure time does not guarantee it will remain so. Public exploit code for Firefox and CVSS >9.0 severity for ColdFusion and Avi Load Balancer indicate intervention priority regardless of exploitation status.

Information verified against cited sources and current as of publication.

Sources

Sources and references