Mozilla Firefox patches multiple arbitrary code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Firefox and Firefox ESR could allow arbitrary code execution; no active exploitation reported.
Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, and related products. The most severe issues include a use-after-free in WebRTC, a sandbox escape in graphics rendering, privilege escalation in the DOM, and JIT miscompilation in the JavaScript engine. Successful exploitation of these flaws could enable arbitrary code execution, allowing an attacker to install programs, access or modify data, or create new accounts depending on the compromised user's privilege level. The advisory notes no current evidence of active exploitation in the wild.
Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. Additional lower-severity vulnerabilities address use-after-free conditions in audio/video processing, spoofing in the downloads panel, privilege escalation in the Netmonitor component, and same-origin policy bypass in request handling. Organizations should prioritize patching immediately after testing, enforce the principle of least privilege to limit impact, and implement endpoint detection and anti-exploitation features.
Mentioned in this report
Detection guidance
Firefox Spawning Command Shell or Scripting Interpreter
Firefox launching cmd, PowerShell, wscript, cscript or mshta as a child process, a possible sign of browser exploitation or sandbox escape after a drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Command Shell or Scripting Interpreter
description: Detects firefox.exe spawning a command shell or script interpreter. Content-process
exploitation (for example use-after-free, JIT miscompilation or a sandbox escape)
that reaches code execution often shows up as the browser launching a shell. Behavioural,
not tied to a specific CVE or sample.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
filter_native_messaging:
CommandLine|contains: nativeMessaging
condition: selection and not filter_native_messaging
falsepositives:
- Enterprise browser extensions or native messaging hosts implemented as batch or
PowerShell scripts
- Users or helpdesk tooling launching scripts through custom Firefox protocol handlers
level: medium
id: 544d86d6-c1f7-538f-b2c2-378bb839cb79
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112
Firefox Spawning Living-off-the-Land Binary
Firefox launching LOLBins such as rundll32, regsvr32, certutil, bitsadmin or msiexec, which is typical of post-exploitation payload staging after a browser drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Living-off-the-Land Binary
description: Detects firefox.exe spawning common download or execution LOLBins. Firefox
does not normally start these, so it suggests a browser exploit staging a payload
on the host.
tags:
- attack.initial-access
- attack.t1189
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
- \installutil.exe
- \regasm.exe
- \msbuild.exe
condition: selection
falsepositives:
- Web-based software installers that hand an MSI package to msiexec through Firefox
level: high
id: ce56b99f-3413-5df4-9efa-45676c1ff975
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs