Firefox

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

This brief details how attackers may leverage the `systemd-run` utility on Linux systems for defense evasion and execution by running commands as detached, transient services or scopes to obscure their activities and parent-child process chains.

Roundup of Google security advisories published in July 2026.

Multiple vulnerabilities in Mozilla Firefox, Firefox ESR, and Thunderbird could allow a remote attacker to execute arbitrary code, disclose information, bypass security restrictions, deceive the user, escalate privileges, or cause a denial-of-service condition.

Multiple vulnerabilities exist in Mozilla Firefox, Firefox ESR, and Thunderbird that could allow a remote attacker to execute arbitrary code, disclose sensitive information, bypass security measures, or conduct cross-site scripting or spoofing attacks.

A new variant of the 'SHub' macOS infostealer, dubbed Reaper, uses AppleScript to display a fake security update message and install a backdoor, ultimately stealing browser data, financial documents, and cryptocurrency wallet information while bypassing Terminal-based mitigations in macOS.

Hackers injected credential-stealing malware into newly published versions of the node-ipc npm package in a supply chain attack, collecting cloud credentials, SSH keys, CI/CD secrets, and other sensitive data, exfiltrating it through DNS TXT queries.

The Atomic macOS Stealer (AMOS) is a prevalent malware-as-a-service targeting macOS, distributed via social engineering techniques like ClickFix ruses and fake installers, designed to steal sensitive data such as credentials and cryptocurrency wallets, leading to potential account compromise and further attacks.

Siemens Teamcenter versions V2312 (before V2312.0014), V2406 (before V2406.0012), V2412 (before V2412.0009), V2506 (before V2506.0005), and V2512 are vulnerable to cross-site scripting (XSS) due to improper encoding or filtering of user-supplied data, potentially leading to arbitrary code execution by other users.

Mozilla released security updates to address vulnerabilities in Firefox and Firefox ESR versions, potentially allowing for exploitation if left unpatched.

Mozilla released a security advisory addressing vulnerabilities in Firefox and Firefox ESR versions prior to 150.0.1, 140.10.1, and 115.35.1, potentially leading to arbitrary code execution or information disclosure.

Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands, leading to initial access and execution of arbitrary code.

CVE-2026-4714 is a high-severity vulnerability affecting Firefox, Firefox ESR, and Thunderbird due to incorrect boundary conditions in the Audio/Video component, potentially leading to denial-of-service.

A Firefox 0-day exploit was used to target Mac users, dropping a second backdoor identified as a new variant of the cross-platform Mokes malware (OSX.Mokes.B) with screen capture, audio capture, and document exfiltration capabilities.

A vulnerability exists in the Audio/Video: GMP component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions, potentially leading to a denial-of-service condition.

OSX/CreativeUpdater is a macOS cryptominer distributed through compromised download links on the MacUpdate website, using a trojanized application bundle to execute a script that downloads and installs a persistent Monero miner using launch agents.

CVE-2026-4712 is an information disclosure vulnerability in the Widget: Cocoa component affecting Firefox versions less than 149, Firefox ESR versions less than 140.9, Thunderbird versions less than 149, and Thunderbird versions less than 140.9, potentially allowing a remote attacker to access sensitive information.

This rule detects the installation of browser extensions, a persistence mechanism where attackers install malicious extensions via app store downloads, social engineering, or compromised systems, focusing on file creation events in extension directories on Windows.

CVE-2026-4686 is a high-severity vulnerability due to incorrect boundary conditions in the Canvas2D component of Mozilla Firefox and Thunderbird, potentially leading to a denial-of-service condition.

CVE-2026-4713 is a high-severity vulnerability due to incorrect boundary conditions in the Graphics component of Mozilla Firefox, Firefox ESR, and Thunderbird, potentially leading to denial of service.

CVE-2026-4708 is a high-severity vulnerability involving incorrect boundary conditions in the Graphics component, impacting Firefox versions earlier than 149, Firefox ESR versions before 140.9, Thunderbird versions before 149, and Thunderbird versions prior to 140.9, potentially leading to a denial-of-service.

CVE-2026-4684 is a race condition and use-after-free vulnerability in the Graphics: WebRender component affecting Firefox versions less than 149, Firefox ESR versions less than 115.34 and 140.9, and Thunderbird versions less than 149 and 140.9, potentially leading to arbitrary code execution.

A critical JIT miscompilation vulnerability (CVE-2026-4702) in the JavaScript Engine affects Firefox and Thunderbird, potentially allowing remote code execution.

An undefined behavior vulnerability in the WebRTC signaling component affects Mozilla Firefox and Thunderbird, potentially leading to arbitrary code execution.

The Mac Malware of 2019 report details various Mac malware specimens and variants, including CookieMiner, a cryptominer that steals user cookies and passwords, likely to give attackers access to victims' online accounts and wallets; CookieMiner persists via launch agents and exfiltrates browser cookies to a remote C2 server.

Detection of processes loading Mozilla NSS/Mozglue libraries (mozglue.dll, nss3.dll) outside of known Mozilla applications, potentially indicating malware or unauthorized activity.

A Firefox zero-day exploit was used to target Mac users, resulting in the installation of the OSX.NetWire.A malware, which establishes persistence and communicates with a command and control server.

A use-after-free vulnerability in the Widget: Cocoa component of Mozilla Firefox (versions less than 149), Firefox ESR (less than 140.9), Thunderbird (less than 149), and Thunderbird (less than 140.9) could lead to arbitrary code execution.

Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.

A Windows anomaly detection identifies non-browser processes accessing browser user data profiles, indicative of credential theft by malware such as SnakeKeylogger, which attempts to gather sensitive browser information.

Detects DNS queries to commonly abused remote monitoring and management (RMM) or remote access software domains from non-browser processes, potentially indicating unauthorized remote access or command and control activity.

CVE-2026-4699 describes an improper check for unusual or exceptional conditions in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird leading to a potential denial-of-service.

The use of taskkill to forcibly terminate browser processes such as Chrome, Firefox, and Edge, often associated with credential-stealing malware like Braodo stealer, is detected, allowing it to unlock and steal sensitive browser data.

Detection of DNS-over-HTTPS (DoH) being enabled via registry modifications on Windows systems, potentially indicating defense evasion and obfuscation of network activity by masking DNS queries.

Adversaries may create scheduled tasks on Windows systems to establish persistence, move laterally, or escalate privileges, and this detection identifies such activity by monitoring Windows event logs for scheduled task creation events, excluding known benign tasks and those created by system accounts.

Attackers masquerade malicious executables as legitimate business application installers to trick users into downloading and executing malware, leveraging defense evasion and initial access techniques.

CVE-2026-4722 is a privilege escalation vulnerability in the IPC component of Mozilla Firefox and Thunderbird versions less than 149, potentially allowing an attacker to gain elevated privileges on a compromised system.

A use-after-free vulnerability (CVE-2026-4691) in the CSS Parsing and Computation component affects Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, and Thunderbird versions prior to 149 and 140.9, potentially leading to arbitrary code execution.

Detection of non-Firefox processes accessing the Firefox profile directory, potentially indicating malware attempting to steal user credentials and data.