# Mozilla Firefox arbitrary code execution vulnerabilities

Published: 2026-06-10 · Severity: routine
Canonical: https://vorant.io/reports/e31fdb55-e9da-598e-8d50-8353429a1d63/mozilla-firefox-arbitrary-code-execution-vulnerabilities

> Multiple memory corruption and integer overflow flaws in Firefox prior to 139.0.4 could allow arbitrary code execution; no active exploitation reported.

Mozilla has patched multiple vulnerabilities in Firefox versions prior to 139.0.4, including canvas memory corruption and JavaScript engine integer overflow issues that could lead to arbitrary code execution. The most severe flaws could allow an attacker to install programs, modify data, or create new accounts depending on user privileges. The vulnerabilities are reachable via drive-by compromise during web browsing. Currently, there are no reports of these vulnerabilities being exploited in the wild, but immediate patching is recommended given the severity of potential impact. Users with administrative privileges face greater risk than those with restricted account permissions.

## Mentioned in this report

- Vulnerabilities: CVE-2025-49709, CVE-2025-49710

## Detection guidance (public sample)

### Firefox Spawning Command Interpreter or LOLBin on Windows

ATT&CK: T1189

Detects firefox.exe spawning a shell, script host or common LOLBin. This is a post-exploitation pattern after a browser memory-corruption or JIT bug is exploited via drive-by, and is rare in normal browsing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Spawning Command Interpreter or LOLBin on Windows
description: Detects firefox.exe spawning a command interpreter, script host or common
  living-off-the-land binary. After a drive-by exploit of a browser memory-corruption
  or JS engine bug, the attacker's first payload stage often launches such a child.
  Normal Firefox children are firefox.exe, plugin-container, updater and crash reporter,
  none of which match here.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \firefox.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \wmic.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Custom enterprise Firefox integrations or native-messaging hosts that launch cmd.exe
  or powershell.exe
- Developers launching helper scripts from Firefox via external protocol handlers
level: high
id: 11ac6b70-663a-53cc-804c-57c6d0e20b12
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055
```

### Firefox Browser Process Spawning Shell on Linux

ATT&CK: T1189

Detects the Firefox binary directly spawning a shell or scripting interpreter on Linux, which may indicate code execution after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox Browser Process Spawning Shell on Linux
description: Detects the Firefox binary (not its wrapper script) spawning a shell
  or scripting interpreter. This can indicate post-exploitation code execution after
  a drive-by browser exploit. Needs context, because some external protocol handlers
  legitimately spawn shells.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /firefox
    - /firefox-bin
    - /firefox-esr
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /python
    - /python3
    - /perl
    - /nc
    - /curl
    - /wget
  condition: selection
falsepositives:
- Desktop external-protocol or MIME handlers that launch helper shell scripts
- Distribution-specific Firefox launcher or profile-migration scripts
level: medium
id: 18be5772-f35a-53ca-8b29-17955ecaa77d
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2025-055

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e31fdb55-e9da-598e-8d50-8353429a1d63/mozilla-firefox-arbitrary-code-execution-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup