# Mozilla Firefox patches multiple arbitrary code execution flaws

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/7e0a22df-2577-5533-bd1f-a426bd82187d/mozilla-firefox-patches-multiple-arbitrary-code-execution-flaws

> Multiple vulnerabilities in Firefox and Firefox ESR could allow arbitrary code execution; no active exploitation reported.

Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, and related products. The most severe issues include a use-after-free in WebRTC, a sandbox escape in graphics rendering, privilege escalation in the DOM, and JIT miscompilation in the JavaScript engine. Successful exploitation of these flaws could enable arbitrary code execution, allowing an attacker to install programs, access or modify data, or create new accounts depending on the compromised user's privilege level. The advisory notes no current evidence of active exploitation in the wild.

Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. Additional lower-severity vulnerabilities address use-after-free conditions in audio/video processing, spoofing in the downloads panel, privilege escalation in the Netmonitor component, and same-origin policy bypass in request handling. Organizations should prioritize patching immediately after testing, enforce the principle of least privilege to limit impact, and implement endpoint detection and anti-exploitation features.

## Mentioned in this report

- Vulnerabilities: CVE-2025-14321, CVE-2025-14322, CVE-2025-14323, CVE-2025-14324, CVE-2025-14325, CVE-2025-14326, CVE-2025-14327, CVE-2025-14328, CVE-2025-14329, CVE-2025-14330, CVE-2025-14331, CVE-2025-14332, CVE-2025-14333

## Detection guidance (public sample)

### Firefox Spawning Command Shell or Scripting Interpreter

ATT&CK: T1189

Firefox launching cmd, PowerShell, wscript, cscript or mshta as a child process, a possible sign of browser exploitation or sandbox escape after a drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Command Shell or Scripting Interpreter
description: Detects firefox.exe spawning a command shell or script interpreter. Content-process
  exploitation (for example use-after-free, JIT miscompilation or a sandbox escape)
  that reaches code execution often shows up as the browser launching a shell. Behavioural,
  not tied to a specific CVE or sample.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  filter_native_messaging:
    CommandLine|contains: nativeMessaging
  condition: selection and not filter_native_messaging
falsepositives:
- Enterprise browser extensions or native messaging hosts implemented as batch or
  PowerShell scripts
- Users or helpdesk tooling launching scripts through custom Firefox protocol handlers
level: medium
id: 544d86d6-c1f7-538f-b2c2-378bb839cb79
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112
```

### Firefox Spawning Living-off-the-Land Binary

ATT&CK: T1189

Firefox launching LOLBins such as rundll32, regsvr32, certutil, bitsadmin or msiexec, which is typical of post-exploitation payload staging after a browser drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Living-off-the-Land Binary
description: Detects firefox.exe spawning common download or execution LOLBins. Firefox
  does not normally start these, so it suggests a browser exploit staging a payload
  on the host.
tags:
- attack.initial-access
- attack.t1189
- attack.stealth
- attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \installutil.exe
    - \regasm.exe
    - \msbuild.exe
  condition: selection
falsepositives:
- Web-based software installers that hand an MSI package to msiexec through Firefox
level: high
id: ce56b99f-3413-5df4-9efa-45676c1ff975
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-112

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7e0a22df-2577-5533-bd1f-a426bd82187d/mozilla-firefox-patches-multiple-arbitrary-code-execution-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup