# Mozilla Firefox and Thunderbird RCE vulnerabilities patched

Published: 2026-06-09 · Severity: elevated
Canonical: https://vorant.io/reports/9a0b7d71-f7ab-5ac2-8455-29d5e1e94934/mozilla-firefox-and-thunderbird-rce-vulnerabilities-patched

> Multiple arbitrary code execution flaws in Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR; no active exploitation reported.

Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe vulnerabilities could allow arbitrary code execution when a user visits a malicious website or opens a crafted email, potentially enabling an attacker to install programs, modify data, or create new accounts depending on user privileges. Currently there are no reports of these vulnerabilities being exploited in the wild. Affected versions include Firefox prior to 136, Firefox ESR prior to 128.8 and 115.21, Thunderbird prior to 136, and Thunderbird ESR prior to 128.8. The vulnerabilities include memory safety bugs, use-after-free conditions, buffer overflows, and logic errors in XSLT sorting and JIT compilation.

## Mentioned in this report

- Vulnerabilities: CVE-2024-43097, CVE-2024-9956, CVE-2025-1930, CVE-2025-1931, CVE-2025-1932, CVE-2025-1933, CVE-2025-1934, CVE-2025-1935, CVE-2025-1936, CVE-2025-1937, CVE-2025-1938, CVE-2025-1939, CVE-2025-1940, CVE-2025-1941, CVE-2025-1942, CVE-2025-1943, CVE-2025-26695, CVE-2025-26696

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Command Shell or Script Host

ATT&CK: T1189

Firefox or Thunderbird launching cmd, PowerShell, or a script host. This is a typical post-exploitation sign of a browser or mail client RCE such as a drive-by or crafted email, and is rare in normal use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Command Shell or Script Host
description: Detects Mozilla Firefox or Thunderbird spawning a command interpreter
  or script host. Browser and mail client memory-corruption RCE (use-after-free, buffer
  overflow, JIT bugs) typically ends with the compromised process launching a shell.
  Generalises on the parent/child relation, not any specific CVE.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Developers or admins using Firefox native-messaging hosts or external protocol handlers
  that wrap cmd or PowerShell
- Custom enterprise browser extensions that launch helper scripts
level: high
id: ddbb9c60-4bdf-5b18-a6db-8a3255aa5086
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-024
```

### Firefox or Thunderbird Spawning Download or Proxy-Execution LOLBin

ATT&CK: T1189

Firefox or Thunderbird spawning living-off-the-land binaries used to download or execute payloads (certutil, bitsadmin, curl, regsvr32, rundll32, msiexec). This suggests payload staging after client-side exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Download or Proxy-Execution LOLBin
description: Detects Firefox or Thunderbird launching binaries commonly abused to
  fetch or proxy-execute a second stage after a client-side exploit. Based on the
  parent/child relation rather than specific arguments.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \msiexec.exe
    - \installutil.exe
    - \regasm.exe
  condition: selection
falsepositives:
- User opening a downloaded MSI installer directly from the Firefox download panel
- Browser-launched rundll32 for printing or file-association handlers on some systems
level: medium
id: c2fc275d-d21e-55ff-8097-d8531a7a21be
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-024
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-024

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9a0b7d71-f7ab-5ac2-8455-29d5e1e94934/mozilla-firefox-and-thunderbird-rce-vulnerabilities-patched.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup