# Mozilla Firefox and Thunderbird memory safety flaws enable code execution

Published: 2026-06-09 · Severity: elevated
Canonical: https://vorant.io/reports/886eef5a-239b-5f2e-89e7-3dcd7a17424d/mozilla-firefox-and-thunderbird-memory-safety-flaws-enable-code-execution

> Multiple memory safety vulnerabilities in Firefox, Firefox ESR, and Thunderbird could allow arbitrary code execution; no active exploitation reported.

Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, and Thunderbird. The most severe are use-after-free and memory safety bugs that could allow arbitrary code execution if successfully exploited. CVE-2025-3028 involves a use-after-free triggered by XSLTProcessor, while CVE-2025-3030 and CVE-2025-3034 cover additional memory safety issues. Impact depends on user privileges; attackers gaining code execution could install programs, modify or delete data, or create new accounts with full user rights.

Affected versions include Firefox prior to 137, Thunderbird prior to ESR 128.9 and 137, Firefox ESR prior to 128.9 and 115.22. The advisory reports no current in-the-wild exploitation. Additional lower-severity vulnerabilities address JIT optimization bugs, file descriptor leaks, URL bar spoofing via Unicode characters, tab title disclosure in AI chatbot contexts, and improper handling of local .url files.

Defenders should immediately apply Mozilla updates after testing, enforce least-privilege principles to limit exploit impact, enable anti-exploitation features (DEP, SIP, Gatekeeper), maintain application allowlisting, and ensure only fully supported browser and email client versions are deployed. Network-based URL filtering and DNS blocking of known malicious domains provide additional defense.

## Mentioned in this report

- Vulnerabilities: CVE-2025-3028, CVE-2025-3029, CVE-2025-3030, CVE-2025-3031, CVE-2025-3032, CVE-2025-3033, CVE-2025-3034, CVE-2025-3035

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Shell or Script Interpreter

ATT&CK: T1189

Firefox or Thunderbird spawning cmd, PowerShell, script hosts or LOLBins, a common post-exploitation sign after browser or mail client memory corruption (e.g. use-after-free) code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Shell or Script Interpreter
id: f3d81069-70bf-512e-a20b-780b1e68388b
status: experimental
description: Detects Mozilla Firefox or Thunderbird spawning command shells, script
  hosts or common living-off-the-land binaries. Browsers and mail clients rarely launch
  these directly, so this is a useful post-exploitation indicator for memory-safety
  exploits such as use-after-free bugs leading to code execution after a drive-by
  visit.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection_parent and selection_child
falsepositives:
- Enterprise extensions or native messaging hosts that launch helper scripts through
  cmd or PowerShell
- Users opening downloaded .msi or script files directly from the browser download
  panel
level: high
author: Vorant
```

### Firefox or Thunderbird Spawning Shell With Download or Reverse Shell Commands on Linux

ATT&CK: T1189

Firefox or Thunderbird on Linux spawning a shell whose command line fetches a payload or opens a reverse shell, indicating possible exploitation of the browser or mail client. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Shell With Download or Reverse Shell Commands
  on Linux
id: a6a2b5f9-cc60-5c13-8e0f-424dc65fcf0d
status: experimental
description: Detects Firefox or Thunderbird processes on Linux spawning a shell whose
  command line contains payload download, encoding or reverse shell patterns. This
  suggests code execution following exploitation of a memory-safety flaw. Generalises
  on the parent/child relation plus suspicious command content, not on any specific
  URL.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /firefox
    - /firefox-bin
    - /firefox-esr
    - /thunderbird
    - /thunderbird-bin
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - chmod +x
    - python -c
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom MIME or protocol handler wrapper scripts that call curl or wget on behalf
  of the browser
- Developer or kiosk setups that launch Firefox via wrapper shell scripts
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-035

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/886eef5a-239b-5f2e-89e7-3dcd7a17424d/mozilla-firefox-and-thunderbird-memory-safety-flaws-enable-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup