Remotely debugging Firefox instances
Summary
Firefox includes a built-in remote debugging feature that allows attackers to access authentication tokens and cookies from a compromised system. By default, Firefox disables this feature, but malware can enable it by modifying configuration files (user.js or prefs.js) to set specific debugging preferences and remove security prompts that would alert the user.
Solution / Mitigation
Blue teams should monitor and add detection alerts for modifications to Firefox configuration files, specifically changes to the settings: devtools.chrome.enabled, devtools.debugger.remote-enabled, and devtools.debugger.prompt-connection. The source also recommends using SSH port forwarding to encrypt debugging traffic if remote access is needed, since the debugging protocol sends data in clear text.
Classification
Original source: https://embracethered.com/blog/posts/2020/cookies-on-firefox/
First tracked: February 12, 2026 at 02:20 PM
Classified by LLM (prompt v3) · confidence: 95%