Mozilla Firefox arbitrary code execution vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple memory corruption and integer overflow flaws in Firefox prior to 139.0.4 could allow arbitrary code execution; no active exploitation reported.
Mozilla has patched multiple vulnerabilities in Firefox versions prior to 139.0.4, including canvas memory corruption and JavaScript engine integer overflow issues that could lead to arbitrary code execution. The most severe flaws could allow an attacker to install programs, modify data, or create new accounts depending on user privileges. The vulnerabilities are reachable via drive-by compromise during web browsing. Currently, there are no reports of these vulnerabilities being exploited in the wild, but immediate patching is recommended given the severity of potential impact. Users with administrative privileges face greater risk than those with restricted account permissions.
Mentioned in this report
Detection guidance
Firefox Spawning Command Interpreter or LOLBin on Windows
Detects firefox.exe spawning a shell, script host or common LOLBin. This is a post-exploitation pattern after a browser memory-corruption or JIT bug is exploited via drive-by, and is rare in normal browsing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Spawning Command Interpreter or LOLBin on Windows
description: Detects firefox.exe spawning a command interpreter, script host or common
living-off-the-land binary. After a drive-by exploit of a browser memory-corruption
or JS engine bug, the attacker's first payload stage often launches such a child.
Normal Firefox children are firefox.exe, plugin-container, updater and crash reporter,
none of which match here.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \firefox.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \wmic.exe
- \msiexec.exe
condition: selection
falsepositives:
- Custom enterprise Firefox integrations or native-messaging hosts that launch cmd.exe
or powershell.exe
- Developers launching helper scripts from Firefox via external protocol handlers
level: high
id: 11ac6b70-663a-53cc-804c-57c6d0e20b12
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055
Firefox Browser Process Spawning Shell on Linux
Detects the Firefox binary directly spawning a shell or scripting interpreter on Linux, which may indicate code execution after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox Browser Process Spawning Shell on Linux
description: Detects the Firefox binary (not its wrapper script) spawning a shell
or scripting interpreter. This can indicate post-exploitation code execution after
a drive-by browser exploit. Needs context, because some external protocol handlers
legitimately spawn shells.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /firefox
- /firefox-bin
- /firefox-esr
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /python
- /python3
- /perl
- /nc
- /curl
- /wget
condition: selection
falsepositives:
- Desktop external-protocol or MIME handlers that launch helper shell scripts
- Distribution-specific Firefox launcher or profile-migration scripts
level: medium
id: 18be5772-f35a-53ca-8b29-17955ecaa77d
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs