Loading story…
Assetnote discovered that two unauthenticated WebPageTest instances in Mozilla’s AWS environment could be chained into remote code execution. The exploit abused ZIP upload and extraction behavior, a trust flaw that let the FASTLY-CLIENT-IP header impersonate 127.0.0.1, and a race condition before uploaded script files were deleted; high-volume request techniques such as Turbo Intruder could support exploitation of timing-sensitive flaws.
Mozilla and the WebPageTest maintainers coordinated remediation, with an upstream patch committed on January 17, 2018. Mozilla awarded the researchers $500 through its bug-bounty program after disclosure; organizations running WebPageTest should ensure they have deployed the upstream fix and prevent client-controlled headers from overriding source-IP trust decisions.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
An upstream WebPageTest commit addressing the reported vulnerabilities was pushed after Mozilla, the WebPageTest team, and the researchers coordinated remediation.
In November 2017, Assetnote identified unauthenticated WebPageTest deployments in Mozilla's AWS environment. The researchers chained ZIP-upload extraction, a spoofed FASTLY-CLIENT-IP header, and a file-removal race condition to obtain remote code execution.
Mozilla's Bugzilla report covering the WebPageTest vulnerability was later made public.
Mozilla awarded the researchers $500 through its bug bounty program after the vulnerability was reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla patched a high-severity Firefox vulnerability, **CVE-2026-10702**, after researchers showed that visiting a single malicious webpage could trigger arbitrary code execution inside the browser’s sandboxed renderer process. The flaw was traced to the SpiderMonkey JavaScript engine, where JIT optimization involving `Object.keys()`, `length`, and prototype handling could lead to a **use-after-free** condition. Reported affected versions include Firefox stable releases from **147 through 151.0.2**, while **Firefox ESR 140.12** was not listed as affected. Researchers at Nebula Security said the same bug could also be used against **Tor Browser** builds based on vulnerable Firefox versions, allowing compromise from a webpage visit alone. Nebula published exploit material and used the bug as the first stage of an **IonStack** exploit chain, pairing it with **CVE-2026-43499** ("GhostLock"), a Linux kernel futex flaw, to obtain root on a supported **ARM64 Android 17** Google build. Available reporting said there was **no confirmed in-the-wild exploitation** against users at the time of disclosure.
Jul 29, 2026
A critical vulnerability, tracked as CVE-2025-13016, was discovered in the WebAssembly engine's JavaScript component of Mozilla Firefox and Thunderbird, exposing over 180 million users to the risk of arbitrary code execution. The flaw, introduced in April 2025, results from incorrect boundary conditions in pointer arithmetic within the garbage collection process, leading to a stack buffer overflow. Attackers can exploit this vulnerability by luring users to malicious websites or sending crafted email content, potentially gaining complete control over the affected browser or mail client process. The vulnerability affects Firefox versions below 145 and Thunderbird versions prior to 145, including their respective ESR releases. Mozilla responded promptly by releasing security patches in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird ESR 140.5. Security experts and vendors have emphasized the importance of immediate updates to mitigate the risk, as the flaw remained undetected for six months and could have compromised sensitive user data. Organizations and individuals are strongly advised to deploy the latest updates to ensure protection against potential exploitation of this high-severity vulnerability.
Jun 29, 2026
Mozilla released a security advisory addressing a critical vulnerability in Firefox, identified as CVE-2025-12380, which affects versions prior to 144.0.2. The flaw allows a compromised child process to trigger a use-after-free condition in the GPU or browser process via WebGPU-related IPC calls, potentially enabling sandbox escape. Security researchers have rated this vulnerability as critical (CVSS 9.8), and it is remotely exploitable, posing a significant risk to users of affected Firefox versions. The Canadian Centre for Cyber Security and other sources have urged users and administrators to review the official Mozilla security advisories and apply the necessary updates immediately to mitigate the risk. The vulnerability highlights the importance of timely patching, especially for widely used browsers like Firefox, to prevent exploitation by threat actors targeting browser sandboxing mechanisms.
Jun 29, 2026