Firefox/Tor Browser mprotect call followed by ARM64 shellcode execution via WASM redirection

Ethan Andrews@eandrews

•updated Jul 29, 2026•9•0•12

Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.