Rule Category

BROWSER-FIREFOX -- Snort has detected traffic known to exploit vulnerabilities present in the Firefox browser, or products that have the "Gecko" engine (Thunderbird email client, etc.).

Alert Message

BROWSER-FIREFOX Mozilla Firefox ESR NotifyTimeChange use after free attempt

Rule Explanation

This event is generated when an attacker attempts to exploit a use after free vulnerability affecting Mozilla Firefox. Impact: Attempted User Privilege Gain Details: This rule checks for an attempt to trigger a use after free vulnerability in Firefox's handling of SVG animations. Ease of Attack: Simple; exploits are publicly-available

What To Look For

Known Usage

No public information

False Positives

No known false positives


Cisco Talos Intelligence Group

MITRE ATT&CK Framework



For reference, see the MITRE ATT&CK vulnerability types here:

Additional Links

Rule Vulnerability

CVE Additional Information