# Mozilla Firefox, Thunderbird patched for arbitrary code execution

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/76eda388-84aa-5943-8f83-d85021355125/mozilla-firefox-thunderbird-patched-for-arbitrary-code-execution

> Multiple memory corruption vulnerabilities in Mozilla products could allow arbitrary code execution; no active exploitation reported yet.

CIS advisory 2025-077 documents multiple vulnerabilities across Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR, and Focus/Firefox for iOS. The most critical are memory corruption flaws in the GMP encrypted-media process and JavaScript engine that could permit arbitrary code execution on affected systems. Additional vulnerabilities include same-origin policy bypass in Canvas2D, Content-Disposition header mishandling allowing XSS on iOS variants, FIDO/passkey hijacking via malicious pages in Focus for iOS, popup-blocker bypass leading to tab-spam DoS, address-bar spoofing, and script-injection via dragged JavaScript links. No exploitation in the wild has been reported. Impact depends on user privilege level; administrative accounts face higher risk. Patched versions are Firefox 142, Firefox ESR 140.2/128.14/115.27, Thunderbird 142, Thunderbird ESR 140.2/128.14, and Focus/Firefox for iOS 142.

## Mentioned in this report

- Vulnerabilities: CVE-2025-55028, CVE-2025-55029, CVE-2025-55030, CVE-2025-55031, CVE-2025-55032, CVE-2025-55033, CVE-2025-9179, CVE-2025-9180, CVE-2025-9181, CVE-2025-9182, CVE-2025-9183, CVE-2025-9184, CVE-2025-9185, CVE-2025-9186, CVE-2025-9187

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Script Interpreter or LOLBin on Windows

ATT&CK: T1203

Detects Firefox or Thunderbird launching a shell, script host or common LOLBin, a likely post-exploitation sign after a browser or mail client memory-corruption or JavaScript-engine exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Script Interpreter or LOLBin on Windows
id: 24d95e95-4f5e-57bb-887a-a34a9ae32bed
status: experimental
description: Detects Mozilla Firefox or Thunderbird spawning a command interpreter,
  script host or common living-off-the-land binary. Normal browsing and mail use do
  not start these children, so this pattern suggests client-side code execution after
  exploitation of a memory-corruption or JavaScript-engine flaw. Generalises on the
  parent/child relation, not on any specific CVE or payload.
tags:
- attack.execution
- attack.t1203
- attack.t1059.007
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Users opening a downloaded file or mail attachment via a configured external handler
  that is a script or installer
- Enterprise or developer tooling that registers a native-messaging host launched
  through a shell
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077
```

### Firefox or Thunderbird Spawning Shell or Download Utility on Linux

ATT&CK: T1203

Detects Firefox or Thunderbird on Linux spawning a shell, scripting runtime or download utility, a likely sign of client-side exploit code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Shell or Download Utility on Linux
id: f884a7db-dc00-5dc2-8518-47676bec1c2f
status: experimental
description: Detects Mozilla Firefox or Thunderbird processes on Linux spawning a
  shell, scripting runtime or network download or reverse-shell utility. This is a
  possible post-exploitation sign after exploitation of a browser or mail client flaw.
  Benign xdg-open and distribution wrapper launches are excluded.
tags:
- attack.execution
- attack.t1203
- attack.t1059.007
- attack.t1189
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /firefox
    - /firefox-bin
    - /firefox-esr
    - /thunderbird
    - /thunderbird-bin
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /python
    - /python3
    - /perl
    - /nc
    - /ncat
    - /curl
    - /wget
  filter_benign_launchers:
    CommandLine|contains:
    - xdg-open
    - xdg-settings
    - /usr/lib/firefox
    - /usr/lib/thunderbird
    - /snap/
  condition: selection and not filter_benign_launchers
falsepositives:
- Desktop integration wrappers that launch helper scripts through a shell under a
  different path
- Users opening downloaded files with a custom external handler script
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-077

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/76eda388-84aa-5943-8f83-d85021355125/mozilla-firefox-thunderbird-patched-for-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup