Mozilla Firefox and Thunderbird critical code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple critical vulnerabilities in Firefox and Thunderbird could allow arbitrary code execution; no active exploitation reported yet.
CIS MS-ISAC has published an advisory detailing multiple vulnerabilities across Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe flaws enable arbitrary code execution through drive-by compromise and sandbox escape conditions. Critical issues include memory safety bugs (CVE-2026-0891, CVE-2026-0892), use-after-free conditions in IPC and JavaScript components (CVE-2026-0882, CVE-2026-0884, CVE-2026-0885), sandbox escapes due to boundary condition and integer overflow issues in Graphics and DOM components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0881), and mitigation bypass in DOM security (CVE-2026-0877). Lower-severity issues include information disclosure, clickjacking, spoofing, and denial-of-service conditions.
Affected versions include Firefox prior to 147, Firefox ESR prior to 115.32 and 140.7, Thunderbird prior to 147, and Thunderbird ESR prior to 140.7. The advisory reports no current in-the-wild exploitation. Impact ranges from full code execution with administrative privileges to lesser compromise on restricted user accounts. Defenders should prioritize patching immediately, enforce least-privilege user access, deploy endpoint detection capabilities, and maintain browser allowlist controls.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Command Shell or Script Interpreter
Firefox/Thunderbird spawning cmd, PowerShell or script hosts - possible post-exploitation after browser or mail client code execution or sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Command Shell or Script Interpreter
id: cbce2eca-acc2-52f5-aafc-53bd53346f3d
status: experimental
description: Detects Firefox or Thunderbird (including ESR builds) launching a command
shell or script interpreter. Browsers and mail clients rarely start these directly,
so this can indicate post-exploitation after a drive-by memory corruption, use-after-free
or sandbox escape. Generalises on the parent/child relation, not on any CVE.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \wmic.exe
condition: selection
falsepositives:
- Browser extensions or native messaging hosts that deliberately launch scripts via
cmd.exe
- Developers or helpdesk tooling that launches batch files from Firefox external protocol
handlers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001
Firefox or Thunderbird Spawning Living-off-the-Land Binary
Firefox/Thunderbird spawning download or proxy-execution LOLBins such as certutil, bitsadmin, rundll32 or regsvr32, which suggests payload staging after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Living-off-the-Land Binary
id: 4a9d8245-7ee8-5e6b-9551-dc2bf6d3eb63
status: experimental
description: Detects Firefox or Thunderbird launching Windows binaries commonly abused
to download or proxy-execute payloads. Such a child process after a drive-by compromise
or sandbox escape would indicate payload staging.
tags:
- attack.initial-access
- attack.t1189
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
- \msiexec.exe
- \installutil.exe
- \regasm.exe
- \curl.exe
- \schtasks.exe
filter_msi_update:
Image|endswith: \msiexec.exe
CommandLine|contains: Mozilla
condition: selection and not filter_msi_update
falsepositives:
- Users opening a downloaded MSI installer directly from the Firefox download panel
- Enterprise add-in or update deployment launched from the browser
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs