# Mozilla Firefox and Thunderbird RCE via memory safety flaws

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/f8692929-3f42-56f5-8021-331be282b1f2/mozilla-firefox-and-thunderbird-rce-via-memory-safety-flaws

> Multiple memory safety vulnerabilities in Mozilla Firefox and Thunderbird could allow arbitrary code execution; no active exploitation reported.

Mozilla has released security updates addressing multiple vulnerabilities across Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe vulnerabilities are memory safety issues that could lead to arbitrary code execution, including a use-after-free in MediaTrackGraphImpl, out-of-bounds read/write in WebGL texture handling, and cross-process information disclosure via malicious IPC messages. Additional vulnerabilities address property modification, sandboxed iframe behavior on Android, password field exposure, object tag type override, address bar spoofing, and native messaging API issues. No active exploitation has been reported in the wild.

Affected versions include Firefox prior to 144, Firefox ESR prior to 115.29 and 140.4, Thunderbird prior to 144, and Thunderbird ESR prior to 140.4. Successful exploitation depends on user privileges; attackers could install programs, modify data, or create accounts with the user's rights. Defenders should prioritize patching across all affected versions and implement least-privilege account practices to limit impact.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711, CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715, CVE-2025-11716, CVE-2025-11717, CVE-2025-11718, CVE-2025-11719, CVE-2025-11720, CVE-2025-11721

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Command Interpreter or LOLBin

ATT&CK: T1189

Detects Firefox or Thunderbird spawning a shell, script host or common LOLBin, which is a typical post-exploitation outcome after a browser or mail client memory-corruption RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Command Interpreter or LOLBin
id: 6de12dbc-b1ef-5d85-9022-83d850119b1e
status: experimental
description: Detects Firefox or Thunderbird spawning a shell, script host or common
  LOLBin. A successful memory-safety exploit (for example use-after-free or WebGL
  out-of-bounds) in the browser or mail client commonly results in child processes
  running with the user's rights. Generalises on the parent/child relation, not on
  a specific CVE or payload.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Native messaging hosts or enterprise extensions that deliberately launch a script
  interpreter
- Users configuring Firefox to open certain external protocol handlers through a shell
  wrapper
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094
```

### Firefox or Thunderbird Spawning Process From User-Writable Path

ATT&CK: T1189

Detects Firefox or Thunderbird launching a child executable from temp, public, downloads or ProgramData paths, excluding known Mozilla helper binaries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Process From User-Writable Path
id: 108d9d60-22bb-5dc3-b5c8-d80ccf054b0a
status: experimental
description: Detects Firefox or Thunderbird creating a child process whose image is
  in a user-writable location such as Temp, Users\Public, Downloads or ProgramData.
  This can indicate a dropped second-stage payload after a drive-by exploit. Known
  Mozilla helper binaries are excluded.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|contains:
    - \AppData\Local\Temp\
    - \Users\Public\
    - \Downloads\
    - \ProgramData\
  filter_mozilla_helpers:
    Image|endswith:
    - \updater.exe
    - \crashreporter.exe
    - \pingsender.exe
    - \plugin-container.exe
    - \default-browser-agent.exe
    - \minidump-analyzer.exe
    - \firefox.exe
    - \thunderbird.exe
  condition: selection and not filter_mozilla_helpers
falsepositives:
- User opening a downloaded installer or document handler directly from the browser
  download panel
- Firefox application update staging run from a temp directory
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2025-094

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f8692929-3f42-56f5-8021-331be282b1f2/mozilla-firefox-and-thunderbird-rce-via-memory-safety-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup