Mozilla Firefox multiple code execution vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple Mozilla Firefox vulnerabilities enable arbitrary code execution; no wild exploitation reported yet.
CIS released an advisory detailing multiple vulnerabilities affecting Mozilla Firefox and Firefox ESR that could allow arbitrary code execution if successfully exploited. The most severe flaws involve incorrect boundary conditions and race conditions in the Graphics component, sandbox escapes, JIT miscompilation in the JavaScript engine, and memory safety bugs. The affected versions are Firefox prior to 145, Firefox ESR prior to 115.30, and Firefox ESR prior to 140.5. While no active exploitation in the wild has been reported, successful compromise could allow an attacker to install programs, modify or delete data, or create new user accounts with full privileges, with impact depending on the victim's account privileges.
The advisory recommends immediate patching after testing, implementing application patch management on a monthly or more frequent basis, enforcing least privilege principles, enabling anti-exploitation features (DEP, WDEG, SIP, Gatekeeper), and deploying network controls such as DNS filtering and URL filtering. Organizations should prioritize updating all Firefox instances to version 145 or later, and Firefox ESR instances to version 115.30 or 140.5 or later as appropriate.
Mentioned in this report
Detection guidance
Firefox Spawning Script Interpreter or LOLBin Child Process on Windows
Detects firefox.exe spawning a shell, scripting host or common living-off-the-land binary, which is a post-exploitation sign after a browser code-execution or sandbox-escape bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Script Interpreter or LOLBin Child Process on Windows
description: Detects firefox.exe spawning a shell, scripting host or common LOLBin.
Firefox normally only spawns its own processes (content, GPU, updater, crash reporter),
so this child-process pattern suggests code execution after a drive-by exploit or
sandbox escape.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
- \curl.exe
- \wmic.exe
- \schtasks.exe
condition: selection
falsepositives:
- Users opening a downloaded file or external protocol handler that Firefox hands
to rundll32 or msiexec
- Developer or enterprise add-ins that launch helper scripts from Firefox
level: high
id: e37124bf-ed03-5971-8091-5dc39aabe5b0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106
Firefox Spawning Shell or Download Utility on Linux
Detects the Firefox binary spawning a shell, downloader or netcat-style tool on Linux, indicating possible browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Shell or Download Utility on Linux
description: Detects Firefox or Firefox ESR processes spawning an interactive shell,
scripting runtime or network download/connect utility, which suggests post-exploitation
after a memory-corruption or sandbox-escape bug.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /firefox
- /firefox-bin
- /firefox-esr
Image|endswith:
- /bash
- /sh
- /dash
- /zsh
- /nc
- /ncat
- /curl
- /wget
- /python
- /python3
- /perl
filter_handlers:
CommandLine|contains:
- xdg-open
- xdg-mime
- gio open
condition: selection and not filter_handlers
falsepositives:
- Firefox launching wrapper scripts or external application handlers via a shell
- Developer tooling that launches Firefox for automated browser testing
level: medium
id: aa2f8bb6-8828-5764-8d55-3246c1864e88
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs