Mozilla Patches Dozens of Firefox Flaws
MS-ISAC advisory details over 90 Mozilla Firefox and Firefox ESR vulnerabilities, several enabling sandbox escape and arbitrary code execution; no known in-the-wild exploitation.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The Multi-State ISAC issued an advisory covering a large batch of vulnerabilities patched in Mozilla Firefox (prior to version 160) and Firefox ESR (prior to 153.7 and 115.45). The most severe issues are use-after-free, incorrect boundary condition, and sandbox escape bugs across the DOM, Graphics, JavaScript engine, Networking, Audio/Video, Layout, and IPC components, several of which combine sandbox escape with privilege escalation. Successful exploitation of the worst of these could allow an attacker to achieve arbitrary code execution in the context of the logged-in user, potentially leading to installation of programs, data manipulation, or creation of new accounts, with impact scaled by the victim's account privileges.
MS-ISAC states there are currently no reports of these vulnerabilities being exploited in the wild. The advisory enumerates dozens of CVEs, ranging from critical sandbox-escape and privilege-escalation issues to lower-severity information disclosure, spoofing, site-isolation, and clickjacking bugs (the latter affecting Firefox for Android's Autofill component). The volume and diversity of memory-safety bugs (primarily use-after-free and invalid pointer conditions) is consistent with routine Mozilla security releases rather than evidence of a coordinated campaign.
Defenders should prioritize patching to the fixed Firefox/Firefox ESR versions via automated patch management, enforce least-privilege on endpoints, and layer standard browser-hardening controls (exploit protection, URL/DNS filtering, application allowlisting) since drive-by compromise via malicious or compromised web content is the primary initial access vector associated with browser vulnerabilities of this type.
Mentioned in this report
Detection guidance
Firefox Spawning Script Interpreter or LOLBin Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects firefox.exe launching a shell, script host or common LOLBin, which is consistent with post-exploitation after a browser memory-corruption or sandbox-escape bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Script Interpreter or LOLBin Child Process
description: Detects firefox.exe directly spawning a command shell, script host or
living-off-the-land binary. Firefox normally only spawns itself, plugin-container,
crashreporter, updater and similar helpers, so this pattern is consistent with drive-by
exploitation (memory corruption or sandbox escape) leading to code execution. Matches
the parent/child relation, not any specific CVE or payload.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- User opening a downloaded script or installer directly from the Firefox download
panel, which hands off to a shell or msiexec
- Enterprise helper applications or protocol handlers registered to launch via cmd.exe
from Firefox
level: medium
id: fc21284e-69f2-5b1e-b390-212c31bed400
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131
Firefox Spawning Host Reconnaissance Utilities
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects firefox.exe spawning discovery utilities such as whoami, net or systeminfo, typical of first actions after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Host Reconnaissance Utilities
description: Detects firefox.exe spawning built-in discovery tools (whoami, net, systeminfo,
nltest, tasklist, ipconfig, arp). Browsers have no legitimate reason to run these,
so a hit suggests attacker code running in the browser process context after a drive-by
exploit.
tags:
- attack.initial-access
- attack.t1189
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \whoami.exe
- \net.exe
- \net1.exe
- \systeminfo.exe
- \nltest.exe
- \tasklist.exe
- \ipconfig.exe
- \arp.exe
- \quser.exe
condition: selection
falsepositives:
- Browser extensions or native-messaging hosts that shell out to network diagnostic
tools
level: high
id: a0df1bba-82d9-508a-bed3-6c5fdbe0aee3
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs