# Mozilla Firefox multiple code execution vulnerabilities

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/76bcc174-2215-5d06-a29f-914956a6abee/mozilla-firefox-multiple-code-execution-vulnerabilities

> Multiple Mozilla Firefox vulnerabilities enable arbitrary code execution; no wild exploitation reported yet.

CIS released an advisory detailing multiple vulnerabilities affecting Mozilla Firefox and Firefox ESR that could allow arbitrary code execution if successfully exploited. The most severe flaws involve incorrect boundary conditions and race conditions in the Graphics component, sandbox escapes, JIT miscompilation in the JavaScript engine, and memory safety bugs. The affected versions are Firefox prior to 145, Firefox ESR prior to 115.30, and Firefox ESR prior to 140.5. While no active exploitation in the wild has been reported, successful compromise could allow an attacker to install programs, modify or delete data, or create new user accounts with full privileges, with impact depending on the victim's account privileges.

The advisory recommends immediate patching after testing, implementing application patch management on a monthly or more frequent basis, enforcing least privilege principles, enabling anti-exploitation features (DEP, WDEG, SIP, Gatekeeper), and deploying network controls such as DNS filtering and URL filtering. Organizations should prioritize updating all Firefox instances to version 145 or later, and Firefox ESR instances to version 115.30 or 140.5 or later as appropriate.

## Mentioned in this report

- Vulnerabilities: CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019, CVE-2025-13020, CVE-2025-13021, CVE-2025-13022, CVE-2025-13023, CVE-2025-13024, CVE-2025-13025, CVE-2025-13026, CVE-2025-13027

## Detection guidance (public sample)

### Firefox Spawning Script Interpreter or LOLBin Child Process on Windows

ATT&CK: T1189

Detects firefox.exe spawning a shell, scripting host or common living-off-the-land binary, which is a post-exploitation sign after a browser code-execution or sandbox-escape bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Script Interpreter or LOLBin Child Process on Windows
description: Detects firefox.exe spawning a shell, scripting host or common LOLBin.
  Firefox normally only spawns its own processes (content, GPU, updater, crash reporter),
  so this child-process pattern suggests code execution after a drive-by exploit or
  sandbox escape.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \curl.exe
    - \wmic.exe
    - \schtasks.exe
  condition: selection
falsepositives:
- Users opening a downloaded file or external protocol handler that Firefox hands
  to rundll32 or msiexec
- Developer or enterprise add-ins that launch helper scripts from Firefox
level: high
id: e37124bf-ed03-5971-8091-5dc39aabe5b0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106
```

### Firefox Spawning Shell or Download Utility on Linux

ATT&CK: T1189

Detects the Firefox binary spawning a shell, downloader or netcat-style tool on Linux, indicating possible browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Shell or Download Utility on Linux
description: Detects Firefox or Firefox ESR processes spawning an interactive shell,
  scripting runtime or network download/connect utility, which suggests post-exploitation
  after a memory-corruption or sandbox-escape bug.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /firefox
    - /firefox-bin
    - /firefox-esr
    Image|endswith:
    - /bash
    - /sh
    - /dash
    - /zsh
    - /nc
    - /ncat
    - /curl
    - /wget
    - /python
    - /python3
    - /perl
  filter_handlers:
    CommandLine|contains:
    - xdg-open
    - xdg-mime
    - gio open
  condition: selection and not filter_handlers
falsepositives:
- Firefox launching wrapper scripts or external application handlers via a shell
- Developer tooling that launches Firefox for automated browser testing
level: medium
id: aa2f8bb6-8828-5764-8d55-3246c1864e88
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-106

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/76bcc174-2215-5d06-a29f-914956a6abee/mozilla-firefox-multiple-code-execution-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup