# Mozilla Firefox, Thunderbird patches critical sandbox escapes

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/06cc37b3-b8a2-563a-9c1a-35b27e8d5751/mozilla-firefox-thunderbird-patches-critical-sandbox-escapes

> Mozilla released patches for critical arbitrary code execution flaws in Firefox, Thunderbird, and Focus; no active exploitation reported.

Mozilla has issued updates addressing multiple vulnerabilities across Firefox, Firefox ESR, Thunderbird, Thunderbird ESR, and Focus for iOS. The most severe flaws are sandbox escapes in the Graphics component—CVE-2025-10527 (use-after-free) and CVE-2025-10528 (undefined behavior)—that could enable arbitrary code execution when exploited. CVE-2025-10537 covers additional memory safety bugs with potential for code execution. The advisory also covers lower-severity issues including same-origin policy bypass (CVE-2025-10529), JavaScript boundary condition errors (CVE-2025-10532), SVG integer overflow (CVE-2025-10533), information disclosure flaws, and spoofing vulnerabilities in WebAuthn and Site Permissions. No public exploitation has been reported. Defenders must apply updates immediately to all affected versions: Firefox <143, Firefox ESR <140.3 and <115.28, Thunderbird <140.3 and <143, and Focus for iOS <143.0. Impact depends on user privilege level; administrative accounts face the highest risk.

## Mentioned in this report

- Vulnerabilities: CVE-2025-10290, CVE-2025-10527, CVE-2025-10528, CVE-2025-10529, CVE-2025-10530, CVE-2025-10531, CVE-2025-10532, CVE-2025-10533, CVE-2025-10534, CVE-2025-10535, CVE-2025-10536, CVE-2025-10537

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Shell or Script Interpreter

ATT&CK: T1189

Firefox or Thunderbird launching cmd, PowerShell, script hosts or LOLBins, a possible post-exploitation or sandbox-escape pattern after a drive-by browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Shell or Script Interpreter
description: Detects Mozilla Firefox or Thunderbird spawning a command shell, script
  host or common LOLBin. Normal browsing does not do this, but a successful memory-corruption
  or sandbox-escape exploit (such as the Graphics component flaws in the Mozilla advisory)
  commonly results in a child shell. Behavioural only, no CVE-specific artefacts.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Users opening a downloaded script or installer directly from the Firefox download
  panel or a Thunderbird attachment
- Enterprise extensions or native-messaging hosts that deliberately launch a shell
level: medium
id: 839d7c4f-0465-51c4-bc01-60a24ca25713
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085
```

### Firefox Content Process Spawning Unexpected Child Process

ATT&CK: T1189

A Firefox sandboxed content process (-contentproc) creating a child process other than Firefox helpers, which indicates a possible sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Content Process Spawning Unexpected Child Process
description: Detects a Firefox content process (parent command line contains -contentproc)
  spawning a child that is not a Firefox helper. Content processes are sandboxed and
  should not create arbitrary processes, so this indicates a possible renderer compromise
  and sandbox escape.
tags:
- attack.initial-access
- attack.t1189
- attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    ParentCommandLine|contains: -contentproc
  filter_helpers:
    Image|endswith:
    - \firefox.exe
    - \plugin-container.exe
    - \crashreporter.exe
    - \WerFault.exe
    - \conhost.exe
  condition: selection and not filter_helpers
falsepositives:
- Third-party security or accessibility software injecting helper processes into the
  Firefox content process
- Crash handling tools other than WerFault that are launched on a content process
  crash
level: high
id: b4353ce6-e415-5ab1-bb46-e1785f7a01e7
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-085

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/06cc37b3-b8a2-563a-9c1a-35b27e8d5751/mozilla-firefox-thunderbird-patches-critical-sandbox-escapes.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup