Firefox smart_window Private URL Exfiltration — CVE Exploitarium PoC Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.