Many ROP errors in Firefox

Question

Hi there. 
 
 Our company starts to use Sophos Central this year. We get many ROP errors with Firefox. Sometimes a site will load normaly, sometimes Sophos shows an ROP error and a Sophos services will push the systemload to nearly 100%. 
 Best example is the login page from Sophos Central. At the same time in works on Chrome.

It seams like a lot of false positives. What can we do to stop this. 
 
 (OS is always Win 10 and i dont realy understand what a ROP error is)

SaschaParis · Accepted Answer

Sadly not, as the plugins are running inside the browser process(es). No way to distinguish for the AV to create a specific exception. I take those ROP's in browsers personally as informational only, at least if they occur only intermittently. As they got blocked, nothing bad happened, and a ROP event also doesn't lead to a termination of the browser process, it usually - besides of the ROP notification popup - doesn't interfere with your workflow as websurfing continues to work normally. 
 You can expect that detected  ROP  events are a legit detection, but in browsers often gets triggered by non conform or strange coded plugins and not necessarily due a real attack. 
 ROP is a finally Method, not a Malware. It's only a potential threat/malicious behaviour depending on the according context why a ROP event occurs.

SaschaParis · Answer

I've made the experience, that ROP events in browsers in most cases aren't related to the browser itself, but one of the installed addons/plugins (your adblockers, and other tools) that triggers that behaviour. That's also the reason why it mostly triggers on one browser, but not another...(no / different addons) 
 A ROP event also necessarily hasn't to be bad/a real attack. But it indicates, that there is that ROP technique used by intent/by accident. 
 This document explains the various techniques to get an idea what all the "ROP", "DEP", "LOCKDOWN" etc. Stuff means, if you want to update your knowledge about exploit techniques 
 https://www.sophos.com/en-us/medialibrary/Gated-Assets/white-papers/Sophos-Comprehensive-Exploit-Prevention-wpna.pdf