What is the CVSS score of CVE-2026-15718?

CVE-2026-15718 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Mozilla Firefox CVE-2026-15718

EUVD-2026-43662 MEDIUM

Release of Invalid Pointer or Reference (CWE-763)

2026-07-14 mozilla

GHSA-6f82-p732-9cp8

Mozilla Information Disclosure

4.3

CVSS 3.1 · Vendor: mozilla

Severity by source

Vendor (mozilla) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered browser flaw requiring user navigation (UI:R, PR:N); impact confined to limited memory read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:05 vuln.today

CVSS changed

Jul 14, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jul 14, 2026 - 12:15 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 12:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.

AnalysisAI

Information disclosure in Mozilla Firefox via CWE-763 (Release of Invalid Pointer or Reference) allows network-based attackers to read limited memory contents from affected browser instances. All Firefox versions prior to 152.0.6 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted malicious web page

Exploit

User navigates to page (social engineering or malvertising)

Execution

Firefox processes content triggering CWE-763 invalid pointer release

Impact

Limited browser memory contents disclosed to attacker

Access

Attacker hosts crafted malicious web page

Exploit

User navigates to page (social engineering or malvertising)

Execution

Firefox processes content triggering CWE-763 invalid pointer release

Impact

Limited browser memory contents disclosed to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a user actively interact with attacker-controlled content - specifically, visiting a malicious web page or opening a crafted file in the browser (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable vector requiring no privileges (PR:N) but mandating user interaction (UI:R), with only low confidentiality impact (C:L) and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted content designed to trigger the CWE-763 invalid pointer release within Firefox's rendering engine. When a user navigates to the page, the browser processes the content and the flaw is triggered, leaking a limited amount of browser memory to the attacker - potentially including fragments of sensitive in-memory data. …
Remediation	Upgrade to Firefox 152.0.6 or later, which is confirmed by Mozilla as the patched release per the advisory at https://www.mozilla.org/security/advisories/mfsa2026-67/ and the associated Bugzilla report at https://bugzilla.mozilla.org/show_bug.cgi?id=2045443. … Detailed patch versions, workarounds, and compensating controls in full report.