Mozilla Firefox, Thunderbird patches critical sandbox escapes
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Mozilla released patches for critical arbitrary code execution flaws in Firefox, Thunderbird, and Focus; no active exploitation reported.
Mozilla has issued updates addressing multiple vulnerabilities across Firefox, Firefox ESR, Thunderbird, Thunderbird ESR, and Focus for iOS. The most severe flaws are sandbox escapes in the Graphics component—CVE-2025-10527 (use-after-free) and CVE-2025-10528 (undefined behavior)—that could enable arbitrary code execution when exploited. CVE-2025-10537 covers additional memory safety bugs with potential for code execution. The advisory also covers lower-severity issues including same-origin policy bypass (CVE-2025-10529), JavaScript boundary condition errors (CVE-2025-10532), SVG integer overflow (CVE-2025-10533), information disclosure flaws, and spoofing vulnerabilities in WebAuthn and Site Permissions. No public exploitation has been reported. Defenders must apply updates immediately to all affected versions: Firefox <143, Firefox ESR <140.3 and <115.28, Thunderbird <140.3 and <143, and Focus for iOS <143.0. Impact depends on user privilege level; administrative accounts face the highest risk.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Shell or Script Interpreter
Firefox or Thunderbird launching cmd, PowerShell, script hosts or LOLBins, a possible post-exploitation or sandbox-escape pattern after a drive-by browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Shell or Script Interpreter
description: Detects Mozilla Firefox or Thunderbird spawning a command shell, script
host or common LOLBin. Normal browsing does not do this, but a successful memory-corruption
or sandbox-escape exploit (such as the Graphics component flaws in the Mozilla advisory)
commonly results in a child shell. Behavioural only, no CVE-specific artefacts.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Users opening a downloaded script or installer directly from the Firefox download
panel or a Thunderbird attachment
- Enterprise extensions or native-messaging hosts that deliberately launch a shell
level: medium
id: 839d7c4f-0465-51c4-bc01-60a24ca25713
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085
Firefox Content Process Spawning Unexpected Child Process
A Firefox sandboxed content process (-contentproc) creating a child process other than Firefox helpers, which indicates a possible sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Content Process Spawning Unexpected Child Process
description: Detects a Firefox content process (parent command line contains -contentproc)
spawning a child that is not a Firefox helper. Content processes are sandboxed and
should not create arbitrary processes, so this indicates a possible renderer compromise
and sandbox escape.
tags:
- attack.initial-access
- attack.t1189
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
ParentCommandLine|contains: -contentproc
filter_helpers:
Image|endswith:
- \firefox.exe
- \plugin-container.exe
- \crashreporter.exe
- \WerFault.exe
- \conhost.exe
condition: selection and not filter_helpers
falsepositives:
- Third-party security or accessibility software injecting helper processes into the
Firefox content process
- Crash handling tools other than WerFault that are launched on a content process
crash
level: high
id: b4353ce6-e415-5ab1-bb46-e1785f7a01e7
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs