Mozilla Firefox and Thunderbird memory safety flaws enable code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple memory safety vulnerabilities in Firefox, Firefox ESR, and Thunderbird could allow arbitrary code execution; no active exploitation reported.
Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, and Thunderbird. The most severe are use-after-free and memory safety bugs that could allow arbitrary code execution if successfully exploited. CVE-2025-3028 involves a use-after-free triggered by XSLTProcessor, while CVE-2025-3030 and CVE-2025-3034 cover additional memory safety issues. Impact depends on user privileges; attackers gaining code execution could install programs, modify or delete data, or create new accounts with full user rights.
Affected versions include Firefox prior to 137, Thunderbird prior to ESR 128.9 and 137, Firefox ESR prior to 128.9 and 115.22. The advisory reports no current in-the-wild exploitation. Additional lower-severity vulnerabilities address JIT optimization bugs, file descriptor leaks, URL bar spoofing via Unicode characters, tab title disclosure in AI chatbot contexts, and improper handling of local .url files.
Defenders should immediately apply Mozilla updates after testing, enforce least-privilege principles to limit exploit impact, enable anti-exploitation features (DEP, SIP, Gatekeeper), maintain application allowlisting, and ensure only fully supported browser and email client versions are deployed. Network-based URL filtering and DNS blocking of known malicious domains provide additional defense.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Shell or Script Interpreter
Firefox or Thunderbird spawning cmd, PowerShell, script hosts or LOLBins, a common post-exploitation sign after browser or mail client memory corruption (e.g. use-after-free) code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Shell or Script Interpreter
id: f3d81069-70bf-512e-a20b-780b1e68388b
status: experimental
description: Detects Mozilla Firefox or Thunderbird spawning command shells, script
hosts or common living-off-the-land binaries. Browsers and mail clients rarely launch
these directly, so this is a useful post-exploitation indicator for memory-safety
exploits such as use-after-free bugs leading to code execution after a drive-by
visit.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- Enterprise extensions or native messaging hosts that launch helper scripts through
cmd or PowerShell
- Users opening downloaded .msi or script files directly from the browser download
panel
level: high
author: Vorant
Firefox or Thunderbird Spawning Shell With Download or Reverse Shell Commands on Linux
Firefox or Thunderbird on Linux spawning a shell whose command line fetches a payload or opens a reverse shell, indicating possible exploitation of the browser or mail client. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Shell With Download or Reverse Shell Commands
on Linux
id: a6a2b5f9-cc60-5c13-8e0f-424dc65fcf0d
status: experimental
description: Detects Firefox or Thunderbird processes on Linux spawning a shell whose
command line contains payload download, encoding or reverse shell patterns. This
suggests code execution following exploitation of a memory-safety flaw. Generalises
on the parent/child relation plus suspicious command content, not on any specific
URL.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /firefox
- /firefox-bin
- /firefox-esr
- /thunderbird
- /thunderbird-bin
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- base64 -d
- chmod +x
- python -c
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom MIME or protocol handler wrapper scripts that call curl or wget on behalf
of the browser
- Developer or kiosk setups that launch Firefox via wrapper shell scripts
level: high
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs