Firefox smart_window Private URL Exfiltration via Cross-Context Disclosure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.