RomCom exploits Firefox and Windows zero days in the wild#

Damien Schaeffer

• Why: A fully documented, in-the-wild zero-click chain attributed to a Russia-aligned group — a reference-quality case study of browser sandbox escape plus OS privilege escalation.
• What: October 2024 discovery of a zero-click chain: a use-after-free in Firefox's animation timeline (code execution in the sandboxed content process, affecting then-current Firefox and Tor Browser) combined with an undocumented permissive Windows RPC endpoint executing code at medium integrity regardless of caller privilege — sandbox escape and EoP, ending in RomCom's backdoor. (from abstract only)
• How: Fake website redirects to the exploit server; successful exploitation drops and executes the backdoor with no user interaction. Mozilla patched in ~25 hours, Microsoft in early November; the talk covers RomCom's TTPs, victimology, and both exploits in detail.
• Where applicable: Victims were users of then-current Firefox/Tor Browser on Windows; both bugs are patched — the value is as an exploit-chain case study and a capability benchmark for a state-adjacent actor.