Mozilla Firefox and Thunderbird RCE via memory safety flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple memory safety vulnerabilities in Mozilla Firefox and Thunderbird could allow arbitrary code execution; no active exploitation reported.
Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe vulnerabilities are memory safety issues that could lead to arbitrary code execution, including a use-after-free in MediaTrackGraphImpl, out-of-bounds read/write in WebGL texture handling, and cross-process information disclosure via malicious IPC messages. Additional vulnerabilities address property modification, sandboxed iframe behavior on Android, password field exposure, object tag type override, address bar spoofing, and native messaging API issues. No active exploitation has been reported in the wild.
Affected versions include Firefox prior to 144, Firefox ESR prior to 115.29 and 140.4, Thunderbird prior to 144, and Thunderbird ESR prior to 140.4. Successful exploitation depends on user privileges; attackers could install programs, modify data, or create accounts with the user's rights. Defenders should prioritize patching across all affected versions and implement least-privilege account practices to limit impact.
Mentioned in this report
Detection guidance
Firefox or Thunderbird Spawning Command Interpreter or LOLBin
Detects Firefox or Thunderbird spawning a shell, script host or common LOLBin, which is a typical post-exploitation outcome after a browser or mail client memory-corruption RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Command Interpreter or LOLBin
id: 6de12dbc-b1ef-5d85-9022-83d850119b1e
status: experimental
description: Detects Firefox or Thunderbird spawning a shell, script host or common
LOLBin. A successful memory-safety exploit (for example use-after-free or WebGL
out-of-bounds) in the browser or mail client commonly results in child processes
running with the user's rights. Generalises on the parent/child relation, not on
a specific CVE or payload.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Native messaging hosts or enterprise extensions that deliberately launch a script
interpreter
- Users configuring Firefox to open certain external protocol handlers through a shell
wrapper
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094
Firefox or Thunderbird Spawning Process From User-Writable Path
Detects Firefox or Thunderbird launching a child executable from temp, public, downloads or ProgramData paths, excluding known Mozilla helper binaries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firefox or Thunderbird Spawning Process From User-Writable Path
id: 108d9d60-22bb-5dc3-b5c8-d80ccf054b0a
status: experimental
description: Detects Firefox or Thunderbird creating a child process whose image is
in a user-writable location such as Temp, Users\Public, Downloads or ProgramData.
This can indicate a dropped second-stage payload after a drive-by exploit. Known
Mozilla helper binaries are excluded.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \firefox.exe
- \thunderbird.exe
Image|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Downloads\
- \ProgramData\
filter_mozilla_helpers:
Image|endswith:
- \updater.exe
- \crashreporter.exe
- \pingsender.exe
- \plugin-container.exe
- \default-browser-agent.exe
- \minidump-analyzer.exe
- \firefox.exe
- \thunderbird.exe
condition: selection and not filter_mozilla_helpers
falsepositives:
- User opening a downloaded installer or document handler directly from the browser
download panel
- Firefox application update staging run from a temp directory
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs