Firefox Smart Window Silent Enablement and Private URL Exfiltration (CVE-2026-20253)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.