Mozilla Firefox, Thunderbird patched for arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple memory corruption vulnerabilities in Mozilla products could allow arbitrary code execution; no active exploitation reported yet.
CIS advisory 2025-077 documents multiple vulnerabilities across Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR, and Focus/Firefox for iOS. The most critical are memory corruption flaws in the GMP encrypted-media process and JavaScript engine that could permit arbitrary code execution on affected systems. Additional vulnerabilities include same-origin policy bypass in Canvas2D, Content-Disposition header mishandling allowing XSS on iOS variants, FIDO/passkey hijacking via malicious pages in Focus for iOS, popup-blocker bypass leading to tab-spam DoS, address-bar spoofing, and script-injection via dragged JavaScript links. No exploitation in the wild has been reported. Impact depends on user privilege level; administrative accounts face higher risk. Patched versions are Firefox 142, Firefox ESR 140.2/128.14/115.27, Thunderbird 142, Thunderbird ESR 140.2/128.14, and Focus/Firefox for iOS 142.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Script Interpreter or LOLBin on Windows
Detects Firefox or Thunderbird launching a shell, script host or common LOLBin, a likely post-exploitation sign after a browser or mail client memory-corruption or JavaScript-engine exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Script Interpreter or LOLBin on Windows
id: 24d95e95-4f5e-57bb-887a-a34a9ae32bed
status: experimental
description: Detects Mozilla Firefox or Thunderbird spawning a command interpreter,
script host or common living-off-the-land binary. Normal browsing and mail use do
not start these children, so this pattern suggests client-side code execution after
exploitation of a memory-corruption or JavaScript-engine flaw. Generalises on the
parent/child relation, not on any specific CVE or payload.
tags:
- attack.execution
- attack.t1203
- attack.t1059.007
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Users opening a downloaded file or mail attachment via a configured external handler
that is a script or installer
- Enterprise or developer tooling that registers a native-messaging host launched
through a shell
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077
Firefox or Thunderbird Spawning Shell or Download Utility on Linux
Detects Firefox or Thunderbird on Linux spawning a shell, scripting runtime or download utility, a likely sign of client-side exploit code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Shell or Download Utility on Linux
id: f884a7db-dc00-5dc2-8518-47676bec1c2f
status: experimental
description: Detects Mozilla Firefox or Thunderbird processes on Linux spawning a
shell, scripting runtime or network download or reverse-shell utility. This is a
possible post-exploitation sign after exploitation of a browser or mail client flaw.
Benign xdg-open and distribution wrapper launches are excluded.
tags:
- attack.execution
- attack.t1203
- attack.t1059.007
- attack.t1189
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /firefox
- /firefox-bin
- /firefox-esr
- /thunderbird
- /thunderbird-bin
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /python
- /python3
- /perl
- /nc
- /ncat
- /curl
- /wget
filter_benign_launchers:
CommandLine|contains:
- xdg-open
- xdg-settings
- /usr/lib/firefox
- /usr/lib/thunderbird
- /snap/
condition: selection and not filter_benign_launchers
falsepositives:
- Desktop integration wrappers that launch helper scripts through a shell under a
different path
- Users opening downloaded files with a custom external handler script
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs