CVE-2025-4084: Mozilla Firefox RCE Vulnerability

CVE-2025-4084 Overview

CVE-2025-4084 is a local code execution vulnerability in Mozilla Firefox on Windows. The flaw stems from insufficient escaping of special characters in the browser's copy as cURL developer tool feature. An attacker who tricks a user into copying a crafted request and pasting it into a Windows shell can execute arbitrary commands on the user's system. The issue affects Firefox on Windows only; other platforms are not affected. Mozilla fixed the vulnerability in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10. The vulnerability is categorized under [CWE-116] Improper Encoding or Escaping of Output.

Critical Impact

A user who copies a cURL command generated from an attacker-controlled HTTP request and executes it in a Windows shell can trigger local command execution outside the browser sandbox.

Affected Products

• Mozilla Firefox on Windows (prior to the fixed releases)
• Mozilla Firefox ESR prior to 115.23 and prior to 128.10 on Windows
• Mozilla Thunderbird prior to 128.10 on Windows

Discovery Timeline

• 2025-04-29 - CVE-2025-4084 published to NVD
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2025-4084

Vulnerability Analysis

Firefox's developer tools include a Copy as cURL function that converts a captured HTTP request into a reusable curl command. On Windows, the generated command did not properly escape shell metacharacters contained in request fields such as URLs, headers, or body data. When a user pastes the command into cmd.exe or PowerShell, the shell interprets unescaped characters as command syntax rather than literal data.

An attacker who controls a webpage can craft requests containing payloads designed to break out of the quoting used by the generated cURL string. The resulting command, once executed by the user, runs attacker-chosen operating system commands with the privileges of the user running the shell. Exploitation requires user interaction: the victim must open developer tools, copy the request, and execute it locally.

Root Cause

The root cause is improper output encoding ([CWE-116]) in the Windows-specific code path that serializes HTTP request components into a curl command line. Shell-sensitive characters such as %, ^, &, |, and quoting sequences are not neutralized for the Windows command interpreter, allowing injection into the final command string.

Attack Vector

Exploitation follows a social-engineering chain. The attacker hosts a page that triggers an HTTP request containing a crafted URL or header value. The victim inspects the request in Firefox DevTools, selects Copy as cURL, and pastes the string into a Windows shell. The injected metacharacters cause the shell to execute additional commands beyond the intended curl invocation. No network-based remote code execution is possible without this user action.

No verified public proof-of-concept code is available. See the Mozilla Security Advisory MFSA-2025-29 and the Mozilla Bug List Summary for vendor technical details.

Detection Methods for CVE-2025-4084

Indicators of Compromise

• Execution of curl.exe from cmd.exe or powershell.exe immediately followed by unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• curl command lines containing suspicious shell metacharacters (&, |, ^, backticks) or embedded secondary commands.
• Outbound connections to attacker-controlled hosts shortly after a user interacts with Firefox DevTools.

Detection Strategies

• Hunt for process trees where a user-launched shell spawns curl.exe with argument strings that include command separators or redirection operators.
• Correlate browser process activity (firefox.exe) with subsequent terminal sessions that invoke curl using URLs recently visited by the user.
• Flag Firefox installations on Windows endpoints running versions prior to Firefox ESR 115.23 or 128.10 and Thunderbird prior to 128.10.

Monitoring Recommendations

• Enable command-line logging (Windows Event ID 4688 with process command-line auditing) to capture full curl invocations.
• Forward endpoint process telemetry to a centralized analytics platform for retrospective hunting across the fleet.
• Alert on unsigned or unusual child processes of cmd.exe or powershell.exe that follow a curl download.

How to Mitigate CVE-2025-4084

Immediate Actions Required

• Update Firefox, Firefox ESR, and Thunderbird on all Windows endpoints to the fixed releases: Firefox ESR 128.10, Firefox ESR 115.23, or Thunderbird 128.10 or later.
• Advise users and developers to inspect any cURL command copied from browser DevTools before executing it in a Windows shell.
• Review recent endpoint telemetry for suspicious curl.exe invocations originating from interactive shell sessions.

Patch Information

Mozilla addressed the vulnerability in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10. Details are available in the Mozilla Security Advisory MFSA-2025-29, Mozilla Security Advisory MFSA-2025-30, and Mozilla Security Advisory MFSA-2025-32. Debian users should apply the fixes referenced in the Debian LTS Announcement.

Workarounds

• Until patches are deployed, instruct users to avoid the Copy as cURL feature in Firefox DevTools on Windows.
• Prefer Copy as cURL (POSIX) and execute the command inside a POSIX shell such as WSL rather than cmd.exe or PowerShell.
• Restrict developer tool usage on high-risk endpoints through group policy where feasible.

# Verify installed Firefox version on Windows via PowerShell
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion

# Target fixed versions:
#   Firefox ESR >= 128.10
#   Firefox ESR >= 115.23
#   Thunderbird >= 128.10