Mozilla Firefox and ESR arbitrary code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Five vulnerabilities in Firefox and Firefox ESR could allow arbitrary code execution; no active exploitation reported.
Mozilla has patched multiple vulnerabilities across Firefox and Firefox ESR that could lead to arbitrary code execution under a drive-by compromise attack vector. The most severe issues involve use-after-free in the DOM (CVE-2026-8090), incorrect boundary conditions in Audio/Video handling (CVE-2026-8091), and multiple memory safety bugs (CVE-2026-8092, CVE-2026-8093, CVE-2026-8094) in WebRTC and other components. An attacker exploiting these flaws could execute arbitrary code with the privileges of the user running Firefox, potentially enabling installation of malware, data theft, modification or deletion, or account creation. Users with administrative privileges face greater risk than those with limited account rights.
No active exploitation in the wild has been reported at the time of advisory. Remediation requires immediate patching of vulnerable systems: Firefox versions prior to 150.0.2, Firefox ESR prior to 140.10.2, and Firefox ESR prior to 115.35.2. Organizations should apply patches after appropriate testing, enforce privileged account separation for routine browsing, deploy exploit protection mechanisms, maintain application allowlisting policies, and conduct user awareness training on untrusted links and websites.
Mentioned in this report
Detection guidance
Firefox Spawning Shell or Script Interpreter Child Process
Detects firefox.exe spawning a command shell, script host or common LOLBin, a post-exploitation pattern after browser memory-corruption exploitation (drive-by compromise). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Shell or Script Interpreter Child Process
id: 7a97959f-3d20-5faa-bffb-0a5df9c66e4e
status: experimental
description: Detects firefox.exe spawning a command shell, script host or common living-off-the-land
binary. After successful exploitation of a browser memory-corruption flaw (use-after-free,
boundary or memory-safety bugs), code runs as the user and often launches a shell
or downloader. Firefox rarely starts these children in normal use.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
- \wmic.exe
condition: selection
falsepositives:
- Users opening a downloaded script or installer directly from the Firefox download
panel
- Enterprise add-ons or native messaging hosts that launch cmd.exe or PowerShell wrappers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045
Firefox Content Process Spawning Unexpected Child Process
Detects a sandboxed Firefox content process (-contentproc) creating a child that is not another Firefox component, which may indicate renderer exploitation or sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Content Process Spawning Unexpected Child Process
id: 6185a32c-2321-57c2-a488-336d8d73273f
status: experimental
description: Detects a Firefox content (renderer) process, identified by -contentproc
in the parent command line, creating a child process that is not a Firefox helper.
Content processes are sandboxed and do not normally launch other programs, so this
may indicate exploitation of a DOM, media or WebRTC memory-safety bug combined with
a sandbox escape.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
ParentCommandLine|contains: -contentproc
filter_firefox_helpers:
Image|endswith:
- \firefox.exe
- \plugin-container.exe
- \crashreporter.exe
- \WerFault.exe
- \conhost.exe
condition: selection and not filter_firefox_helpers
falsepositives:
- Crash handling or diagnostic tooling launched from a content process after a crash
- Endpoint security agents that inject helper processes into browser processes
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs