Multiple vulnerabilities in Mozilla Firefox and Thunderbird
Multiple flaws in Firefox, Thunderbird, and iOS versions enable remote code execution, privilege escalation, and denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Mozilla products released on 16 June 2026. Affected versions include Firefox versions prior to 152, Firefox ESR versions prior to 115.37 and 140.12, Firefox for iOS prior to 152.0, Thunderbird versions prior to 152, and Thunderbird ESR versions prior to 140.12. The vulnerabilities enable attackers to achieve remote code execution, privilege escalation, denial of service, circumvent security policy, and compromise data confidentiality. The advisory references six Mozilla security bulletins (mfsa2026-56 through mfsa2026-61) and 43 CVE identifiers covering the full scope of issues. Organizations should apply patches immediately as these flaws affect widely-deployed browser and email client software used across enterprise and consumer environments.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Script Interpreter or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Firefox or Thunderbird launching a shell, script host or download LOLBin, a common sign of successful browser or mail client exploitation leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Script Interpreter or LOLBin
description: Detects Mozilla Firefox or Thunderbird directly spawning a command shell,
PowerShell, script host or download/execution LOLBin. Browsers and mail clients
rarely start these, so a hit may indicate client-side exploitation (remote code
execution) or a sandbox escape. The advisory gives no exploit specifics, so this
is generic post-exploitation behaviour.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Browser extensions or native messaging hosts that deliberately launch a script interpreter
- Developers using custom protocol handlers or external-application launchers configured
in Firefox
level: medium
id: 3a6f5c66-ea4f-5823-8c6d-1d7d8198b255
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0764
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0764
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs