# Mozilla Firefox and ESR arbitrary code execution flaws

Published: 2026-05-07 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/25024465-fc68-5023-9793-4520a4d4faaa/mozilla-firefox-and-esr-arbitrary-code-execution-flaws

> Five vulnerabilities in Firefox and Firefox ESR could allow arbitrary code execution; no active exploitation reported.

Mozilla has patched multiple vulnerabilities across Firefox and Firefox ESR that could lead to arbitrary code execution under a drive-by compromise attack vector. The most severe issues involve use-after-free in the DOM (CVE-2026-8090), incorrect boundary conditions in Audio/Video handling (CVE-2026-8091), and multiple memory safety bugs (CVE-2026-8092, CVE-2026-8093, CVE-2026-8094) in WebRTC and other components. An attacker exploiting these flaws could execute arbitrary code with the privileges of the user running Firefox, potentially enabling installation of malware, data theft, modification or deletion, or account creation. Users with administrative privileges face greater risk than those with limited account rights.

No active exploitation in the wild has been reported at the time of advisory. Remediation requires immediate patching of vulnerable systems: Firefox versions prior to 150.0.2, Firefox ESR prior to 140.10.2, and Firefox ESR prior to 115.35.2. Organizations should apply patches after appropriate testing, enforce privileged account separation for routine browsing, deploy exploit protection mechanisms, maintain application allowlisting policies, and conduct user awareness training on untrusted links and websites.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, CVE-2026-8094

## Detection guidance (public sample)

### Firefox Spawning Shell or Script Interpreter Child Process

ATT&CK: T1189

Detects firefox.exe spawning a command shell, script host or common LOLBin, a post-exploitation pattern after browser memory-corruption exploitation (drive-by compromise). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Shell or Script Interpreter Child Process
id: 7a97959f-3d20-5faa-bffb-0a5df9c66e4e
status: experimental
description: Detects firefox.exe spawning a command shell, script host or common living-off-the-land
  binary. After successful exploitation of a browser memory-corruption flaw (use-after-free,
  boundary or memory-safety bugs), code runs as the user and often launches a shell
  or downloader. Firefox rarely starts these children in normal use.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Users opening a downloaded script or installer directly from the Firefox download
  panel
- Enterprise add-ons or native messaging hosts that launch cmd.exe or PowerShell wrappers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045
```

### Firefox Content Process Spawning Unexpected Child Process

ATT&CK: T1189

Detects a sandboxed Firefox content process (-contentproc) creating a child that is not another Firefox component, which may indicate renderer exploitation or sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Content Process Spawning Unexpected Child Process
id: 6185a32c-2321-57c2-a488-336d8d73273f
status: experimental
description: Detects a Firefox content (renderer) process, identified by -contentproc
  in the parent command line, creating a child process that is not a Firefox helper.
  Content processes are sandboxed and do not normally launch other programs, so this
  may indicate exploitation of a DOM, media or WebRTC memory-safety bug combined with
  a sandbox escape.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    ParentCommandLine|contains: -contentproc
  filter_firefox_helpers:
    Image|endswith:
    - \firefox.exe
    - \plugin-container.exe
    - \crashreporter.exe
    - \WerFault.exe
    - \conhost.exe
  condition: selection and not filter_firefox_helpers
falsepositives:
- Crash handling or diagnostic tooling launched from a content process after a crash
- Endpoint security agents that inject helper processes into browser processes
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-045

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/25024465-fc68-5023-9793-4520a4d4faaa/mozilla-firefox-and-esr-arbitrary-code-execution-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup