Firefox exploit found in the wild
概要
Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1.
The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the “same origin policy”) and Firefox’s PDF Viewer. Mozilla products that don’t contain the PDF Viewer, such as Firefox for Android, are not vulnerable. The vulnerability does not enable the execution of arbitrary code but the exploit was able to inject a JavaScript payload into the local file context. This allowed it to search for and upload potentially sensitive local files.
Created: 2026-02-23
Indicators
類似Pulses
このPulseに関連する脅威アクター (事実ベース)
Score: 13.53
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1684 - Social Engineering
- T1055.012 - Process Hollowing
- T1578.001 - Create Snapshot
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 12.51
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1684 - Social Engineering
- T1027.014 - Polymorphic Code
- T1105 - Ingress Tool Transfer
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 4.57
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1578.001 - Create Snapshot
MITREへのリンク →
Score: 4.43
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1684 - Social Engineering
MITREへのリンク →
Score: 9.90
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1105 - Ingress Tool Transfer
- T1578.001 - Create Snapshot
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 7.18
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1684 - Social Engineering
- T1027.014 - Polymorphic Code
MITREへのリンク →
Score: 7.72
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1578.001 - Create Snapshot
- T1546.017 - Udev Rules
MITREへのリンク →
Score: 13.98
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1684 - Social Engineering
- T1027.014 - Polymorphic Code
- T1003.003 - NTDS
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 5.12
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1546.017 - Udev Rules
MITREへのリンク →
Score: 4.64
Matched TTPs:
- T1546.013 - PowerShell Profile
- T1105 - Ingress Tool Transfer
MITREへのリンク →
Score: 7.75
Matched TTPs:
- T1578 - Modify Cloud Compute Infrastructure
- T1003.003 - NTDS
MITREへのリンク →
Score: 3.62
Matched TTPs:
- T1578 - Modify Cloud Compute Infrastructure
MITREへのリンク →
Score: 3.62
Matched TTPs:
- T1578 - Modify Cloud Compute Infrastructure
MITREへのリンク →
Score: 3.62
Matched TTPs:
- T1578 - Modify Cloud Compute Infrastructure
MITREへのリンク →
Score: 3.84
Matched TTPs:
- T1686.003 - Windows Host Firewall
MITREへのリンク →
Score: 6.44
Matched TTPs:
- T1686.003 - Windows Host Firewall
- T1578.001 - Create Snapshot
MITREへのリンク →
Score: 6.59
Matched TTPs:
- T1686.003 - Windows Host Firewall
- T1027.014 - Polymorphic Code
MITREへのリンク →
Score: 5.61
Matched TTPs:
- T1684 - Social Engineering
- T1546.017 - Udev Rules
MITREへのリンク →
Score: 9.26
Matched TTPs:
- T1684 - Social Engineering
- T1490 - Inhibit System Recovery
- T1566.003 - Spearphishing via Service
MITREへのリンク →
Score: 7.00
Matched TTPs:
- T1684 - Social Engineering
- T1686 - Disable or Modify System Firewall
MITREへのリンク →
Score: 5.61
Matched TTPs:
- T1684 - Social Engineering
- T1546.017 - Udev Rules
MITREへのリンク →
Score: 8.38
Matched TTPs:
- T1055.012 - Process Hollowing
- T1592.002 - Software
MITREへのリンク →
Score: 6.44
Matched TTPs:
- T1055.012 - Process Hollowing
- T1578.001 - Create Snapshot
MITREへのリンク →
Score: 5.90
Matched TTPs:
- T1027.014 - Polymorphic Code
- T1546.017 - Udev Rules
MITREへのリンク →
Score: 4.13
Matched TTPs:
- T1130 - Install Root Certificate
MITREへのリンク →
Score: 4.13
Matched TTPs:
- T1130 - Install Root Certificate
MITREへのリンク →
Score: 4.54
Matched TTPs:
- T1543.002 - Systemd Service
MITREへのリンク →
Score: 10.93
Matched TTPs:
- T1105 - Ingress Tool Transfer
- T1055.008 - Ptrace System Calls
- T1566.003 - Spearphishing via Service
MITREへのリンク →
Score: 5.26
Matched TTPs:
- T1105 - Ingress Tool Transfer
- T1578.001 - Create Snapshot
MITREへのリンク →
Score: 5.33
Matched TTPs:
- T1105 - Ingress Tool Transfer
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 9.46
Matched TTPs:
- T1105 - Ingress Tool Transfer
- T1055.008 - Ptrace System Calls
- T1490 - Inhibit System Recovery
MITREへのリンク →
Score: 4.54
Matched TTPs:
- T1094 - Custom Command and Control Protocol
MITREへのリンク →
このPulseに関連する脅威アクター (推論ベース)
Score: 0.78
Matched TTPs:
- T1055.012 - Process Hollowing
- T1684 - Social Engineering
- T1490 - Inhibit System Recovery
- T1578.001 - Create Snapshot
- T1546.013 - PowerShell Profile
MITREへのリンク →
Score: 0.77
Matched TTPs:
- T1684 - Social Engineering
- T1003.003 - NTDS
- T1490 - Inhibit System Recovery
- T1027.014 - Polymorphic Code
- T1546.013 - PowerShell Profile
MITREへのリンク →
Score: 0.72
Matched TTPs:
- T1684 - Social Engineering
- T1490 - Inhibit System Recovery
- T1027.014 - Polymorphic Code
- T1546.013 - PowerShell Profile
- T1105 - Ingress Tool Transfer
MITREへのリンク →
Score: 0.66
Matched TTPs:
- T1055.008 - Ptrace System Calls
- T1566.003 - Spearphishing via Service
- T1105 - Ingress Tool Transfer
MITREへのリンク →
Score: 0.60
Matched TTPs:
- T1490 - Inhibit System Recovery
- T1578.001 - Create Snapshot
- T1546.013 - PowerShell Profile
- T1105 - Ingress Tool Transfer
MITREへのリンク →
Score: 0.58
Matched TTPs:
- T1055.008 - Ptrace System Calls
- T1490 - Inhibit System Recovery
- T1105 - Ingress Tool Transfer
MITREへのリンク →
Related CVEs
このPulseに見つかったCVEはありません。
Pulse – 脅威アクター グラフ
← Pulse一覧に戻る
Trusted Design