Firefox file-stealing exploit found in the wild, Mozilla issues security update patching the vulnerability
Firefox exploit found in the wild — Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched …
Context & Ripple Effects
This 2015 disclosure is the earliest entry in a pattern that keeps repeating in Mozilla's own incident log: an attacker serving malware through Firefox itself, caught live rather than reported responsibly. Here, a user spotted a malicious advertisement on a Russian news site stealing local files, and Mozilla shipped a patch within roughly two days.
The same playbook resurfaces throughout the related coverage: in late 2016 a Firefox zero-day used to unmask Tor users forced a joint Mozilla–Tor emergency update, January 2020 brought two consecutive rounds of patches for an actively exploited memory-access flaw (Jan 9, Jan 10), and September 2023 saw emergency updates covering both Firefox and Thunderbird. Each episode reinforces that Firefox is targeted not opportunistically but as a standing objective.
First-order effects
- Firefox users who loaded pages carrying the malicious Russian ad had local files exposed to theft until they installed Mozilla's security update, which closes the exploited vulnerability.
Second-order effects
- Because the delivery vehicle was an advertisement on a legitimate news site, the burden shifts to that site and its ad network to audit third-party ad supply chains, not just to Mozilla to patch.
Third-order effects
- If the pattern holds — in-the-wild exploits surfacing again in 2016, 2020, and 2023 — Mozilla's release process effectively normalizes off-schedule emergency patches, and shared-code downstream projects like Tor inherit the same exposure and the same fix cadence.
The trend: Browser zero-days discovered in active exploitation are becoming a recurring operational condition for Mozilla, with emergency patching and Tor-coordinated fixes replacing the old scheduled-update rhythm.