## Summary
- Adds a Windows Firefox update policy (`update-firefox.yml`) to detect
outdated Firefox installations vulnerable to CVE-2025-2857
- Adds Firefox as a Fleet-maintained app for Windows workstations
(`firefox/windows`) for self-service installation/update
- Registers both the policy and maintained app in `workstations.yml`
## CVE-2025-2857: Firefox Sandbox Escape on Windows
[CVE-2025-2857](https://nvd.nist.gov/vuln/detail/CVE-2025-2857) is a
**critical** sandbox escape vulnerability in Mozilla Firefox on Windows.
Following the Chrome sandbox escape (CVE-2025-2783), Firefox developers
identified a similar pattern in Firefox's IPC code where a compromised
child process could cause the parent process to return an
unintentionally powerful handle, leading to a sandbox escape.
**Affected versions:**
- Firefox < 136.0.4
- Firefox ESR < 128.8.1
- Firefox ESR < 115.21.1
**Only affects Firefox on Windows.** Other operating systems are
unaffected.
## What was changed and why
The Fleet-maintained Firefox app is already at version 148.0.2 (well
beyond the fix), and macOS workstations already had both an update
policy and software package configured. However, **Windows workstations
had no Firefox update policy or maintained app** — meaning there was no
mechanism to:
1. **Detect** Windows hosts running vulnerable Firefox versions
2. **Remediate** by offering an updated Firefox via self-service
This PR closes that gap by:
1. **`it-and-security/lib/windows/policies/update-firefox.yml`** — New
policy that queries the Windows `programs` table to flag any host with
Firefox < 148.0.2 (uses `LIKE 'Mozilla Firefox%'` and `NOT LIKE '%ESR%'`
to match standard Firefox installations, matching the pattern used in
other Windows update policies)
2. **`it-and-security/fleets/workstations.yml`** — Adds the policy
reference under Windows policies, and adds `firefox/windows` to
`fleet_maintained_apps` for self-service browser installation on x86
Windows hosts
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773774729891479)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: Kilo Code <kilo-bot@kilo.ai>
