# Mozilla Firefox and Thunderbird critical code execution flaws

Published: 2026-06-09 · Severity: elevated · Sectors: government-national, financial-services, technology
Canonical: https://vorant.io/reports/aa16eb20-5797-5cb9-9580-ab6dacdf5800/mozilla-firefox-and-thunderbird-critical-code-execution-flaws

> Multiple critical vulnerabilities in Firefox and Thunderbird could allow arbitrary code execution; no active exploitation reported yet.

CIS MS-ISAC has published an advisory detailing multiple vulnerabilities across Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe flaws enable arbitrary code execution through drive-by compromise and sandbox escape conditions. Critical issues include memory safety bugs (CVE-2026-0891, CVE-2026-0892), use-after-free conditions in IPC and JavaScript components (CVE-2026-0882, CVE-2026-0884, CVE-2026-0885), sandbox escapes due to boundary condition and integer overflow issues in Graphics and DOM components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0881), and mitigation bypass in DOM security (CVE-2026-0877). Lower-severity issues include information disclosure, clickjacking, spoofing, and denial-of-service conditions.

Affected versions include Firefox prior to 147, Firefox ESR prior to 115.32 and 140.7, Thunderbird prior to 147, and Thunderbird ESR prior to 140.7. The advisory reports no current in-the-wild exploitation. Impact ranges from full code execution with administrative privileges to lesser compromise on restricted user accounts. Defenders should prioritize patching immediately, enforce least-privilege user access, deploy endpoint detection capabilities, and maintain browser allowlist controls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-14327, CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0881, CVE-2026-0882, CVE-2026-0883, CVE-2026-0884, CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0888, CVE-2026-0889, CVE-2026-0890, CVE-2026-0891, CVE-2026-0892

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Command Shell or Script Interpreter

ATT&CK: T1189

Firefox/Thunderbird spawning cmd, PowerShell or script hosts - possible post-exploitation after browser or mail client code execution or sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Command Shell or Script Interpreter
id: cbce2eca-acc2-52f5-aafc-53bd53346f3d
status: experimental
description: Detects Firefox or Thunderbird (including ESR builds) launching a command
  shell or script interpreter. Browsers and mail clients rarely start these directly,
  so this can indicate post-exploitation after a drive-by memory corruption, use-after-free
  or sandbox escape. Generalises on the parent/child relation, not on any CVE.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Browser extensions or native messaging hosts that deliberately launch scripts via
  cmd.exe
- Developers or helpdesk tooling that launches batch files from Firefox external protocol
  handlers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001
```

### Firefox or Thunderbird Spawning Living-off-the-Land Binary

ATT&CK: T1189

Firefox/Thunderbird spawning download or proxy-execution LOLBins such as certutil, bitsadmin, rundll32 or regsvr32, which suggests payload staging after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Living-off-the-Land Binary
id: 4a9d8245-7ee8-5e6b-9551-dc2bf6d3eb63
status: experimental
description: Detects Firefox or Thunderbird launching Windows binaries commonly abused
  to download or proxy-execute payloads. Such a child process after a drive-by compromise
  or sandbox escape would indicate payload staging.
tags:
- attack.initial-access
- attack.t1189
- attack.stealth
- attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \msiexec.exe
    - \installutil.exe
    - \regasm.exe
    - \curl.exe
    - \schtasks.exe
  filter_msi_update:
    Image|endswith: \msiexec.exe
    CommandLine|contains: Mozilla
  condition: selection and not filter_msi_update
falsepositives:
- Users opening a downloaded MSI installer directly from the Firefox download panel
- Enterprise add-in or update deployment launched from the browser
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-001

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/aa16eb20-5797-5cb9-9580-ab6dacdf5800/mozilla-firefox-and-thunderbird-critical-code-execution-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup