# Mozilla Patches Dozens of Firefox Flaws

Published: 2026-11-10 · Severity: routine
Canonical: https://vorant.io/reports/8493ceaf-0456-5322-b411-b252c6578f50/mozilla-patches-dozens-of-firefox-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> MS-ISAC advisory details over 90 Mozilla Firefox and Firefox ESR vulnerabilities, several enabling sandbox escape and arbitrary code execution; no known in-the-wild exploitation.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

The Multi-State ISAC issued an advisory covering a large batch of vulnerabilities patched in Mozilla Firefox (prior to version 160) and Firefox ESR (prior to 153.7 and 115.45). The most severe issues are use-after-free, incorrect boundary condition, and sandbox escape bugs across the DOM, Graphics, JavaScript engine, Networking, Audio/Video, Layout, and IPC components, several of which combine sandbox escape with privilege escalation. Successful exploitation of the worst of these could allow an attacker to achieve arbitrary code execution in the context of the logged-in user, potentially leading to installation of programs, data manipulation, or creation of new accounts, with impact scaled by the victim's account privileges.

MS-ISAC states there are currently no reports of these vulnerabilities being exploited in the wild. The advisory enumerates dozens of CVEs, ranging from critical sandbox-escape and privilege-escalation issues to lower-severity information disclosure, spoofing, site-isolation, and clickjacking bugs (the latter affecting Firefox for Android's Autofill component). The volume and diversity of memory-safety bugs (primarily use-after-free and invalid pointer conditions) is consistent with routine Mozilla security releases rather than evidence of a coordinated campaign.

Defenders should prioritize patching to the fixed Firefox/Firefox ESR versions via automated patch management, enforce least-privilege on endpoints, and layer standard browser-hardening controls (exploit protection, URL/DNS filtering, application allowlisting) since drive-by compromise via malicious or compromised web content is the primary initial access vector associated with browser vulnerabilities of this type.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109736, CVE-2026-118007, CVE-2026-118019, CVE-2026-118021, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124872, CVE-2026-124874, CVE-2026-124900, CVE-2026-124902, CVE-2026-124903, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124909, CVE-2026-124911, CVE-2026-124913, CVE-2026-124914, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124921, CVE-2026-124923, CVE-2026-124927, CVE-2026-124931, CVE-2026-124933, CVE-2026-124939, CVE-2026-124951

## Detection guidance (public sample)

### Firefox Spawning Script Interpreter or LOLBin Child Process

ATT&CK: T1189

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects firefox.exe launching a shell, script host or common LOLBin, which is consistent with post-exploitation after a browser memory-corruption or sandbox-escape bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Script Interpreter or LOLBin Child Process
description: Detects firefox.exe directly spawning a command shell, script host or
  living-off-the-land binary. Firefox normally only spawns itself, plugin-container,
  crashreporter, updater and similar helpers, so this pattern is consistent with drive-by
  exploitation (memory corruption or sandbox escape) leading to code execution. Matches
  the parent/child relation, not any specific CVE or payload.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- User opening a downloaded script or installer directly from the Firefox download
  panel, which hands off to a shell or msiexec
- Enterprise helper applications or protocol handlers registered to launch via cmd.exe
  from Firefox
level: medium
id: fc21284e-69f2-5b1e-b390-212c31bed400
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131
```

### Firefox Spawning Host Reconnaissance Utilities

ATT&CK: T1189

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects firefox.exe spawning discovery utilities such as whoami, net or systeminfo, typical of first actions after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Host Reconnaissance Utilities
description: Detects firefox.exe spawning built-in discovery tools (whoami, net, systeminfo,
  nltest, tasklist, ipconfig, arp). Browsers have no legitimate reason to run these,
  so a hit suggests attacker code running in the browser process context after a drive-by
  exploit.
tags:
- attack.initial-access
- attack.t1189
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \systeminfo.exe
    - \nltest.exe
    - \tasklist.exe
    - \ipconfig.exe
    - \arp.exe
    - \quser.exe
  condition: selection
falsepositives:
- Browser extensions or native-messaging hosts that shell out to network diagnostic
  tools
level: high
id: a0df1bba-82d9-508a-bed3-6c5fdbe0aee3
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-131

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8493ceaf-0456-5322-b411-b252c6578f50/mozilla-patches-dozens-of-firefox-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup