Vulnerability-Lookup

OESA-2026-1264 (CVE-2025-14321)

Vulnerability from osv_openeuler – Published: 2026-01-30 11:10 – Updated: 2026-08-06 11:10 – Source website

Summary

thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14321)

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14322)

Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14323)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14324)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14325)

Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird < 140.7.(CVE-2025-14327)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14328)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14329)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14330)

Same-origin policy bypass in the Request Handling component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14331)

Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.(CVE-2025-14333)

Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0877)

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0878)

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0879)

Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0880)

Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0882)

Information disclosure in the Networking component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0883)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0884)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0885)

Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0886)

Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0887)

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0890)

Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.(CVE-2026-0891)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14321	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14322	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14323	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14324	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14325	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14327	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14328	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14329	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14330	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14331	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-14333	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0877	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0878	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0879	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0880	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0882	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0883	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0884	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0885	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0886	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0887	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0890	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-0891	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "thunderbird-140.7.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-debuginfo-140.7.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-debugsource-140.7.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-librnp-rnp-140.7.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-wayland-140.7.0-1.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "thunderbird-140.7.0-1.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "thunderbird-140.7.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-debuginfo-140.7.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-debugsource-140.7.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-librnp-rnp-140.7.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-wayland-140.7.0-1.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "thunderbird",
        "purl": "pkg:rpm/openEuler/thunderbird\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.7.0-1.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nUse-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14321)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 115.31, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14322)\n\nPrivilege escalation in the DOM: Notifications component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 115.31, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14323)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 115.31, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14324)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14325)\n\nSpoofing issue in the Downloads Panel component. This vulnerability affects Firefox \u0026lt; 146, Thunderbird \u0026lt; 146, Firefox ESR \u0026lt; 140.7, and Thunderbird \u0026lt; 140.7.(CVE-2025-14327)\n\nPrivilege escalation in the Netmonitor component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14328)\n\nPrivilege escalation in the Netmonitor component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14329)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14330)\n\nSame-origin policy bypass in the Request Handling component. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 115.31, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14331)\n\nMemory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 146, Firefox ESR \u0026lt; 140.6, Thunderbird \u0026lt; 146, and Thunderbird \u0026lt; 140.6.(CVE-2025-14333)\n\nMitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 115.32, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0877)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0878)\n\nSandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 115.32, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0879)\n\nSandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 115.32, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0880)\n\nUse-after-free in the IPC component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 115.32, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0882)\n\nInformation disclosure in the Networking component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0883)\n\nUse-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0884)\n\nUse-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0885)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 115.32, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0886)\n\nClickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0887)\n\nSpoofing issue in the DOM: Copy \u0026amp; Paste and Drag \u0026amp; Drop component. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0890)\n\nMemory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 147, Firefox ESR \u0026lt; 140.7, Thunderbird \u0026lt; 147, and Thunderbird \u0026lt; 140.7.(CVE-2026-0891)",
  "id": "OESA-2026-1264",
  "modified": "2026-08-06T11:10:17Z",
  "published": "2026-01-30T11:10:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1264"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14321"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14322"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14323"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14324"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14325"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14327"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14328"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14329"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14330"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14331"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14333"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0877"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0878"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0879"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0880"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0882"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0883"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0884"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0885"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0886"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0887"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0890"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0891"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "thunderbird security update",
  "upstream": [
    "CVE-2025-14321",
    "CVE-2025-14322",
    "CVE-2025-14323",
    "CVE-2025-14324",
    "CVE-2025-14325",
    "CVE-2025-14327",
    "CVE-2025-14328",
    "CVE-2025-14329",
    "CVE-2025-14330",
    "CVE-2025-14331",
    "CVE-2025-14333",
    "CVE-2026-0877",
    "CVE-2026-0878",
    "CVE-2026-0879",
    "CVE-2026-0880",
    "CVE-2026-0882",
    "CVE-2026-0883",
    "CVE-2026-0884",
    "CVE-2026-0885",
    "CVE-2026-0886",
    "CVE-2026-0887",
    "CVE-2026-0890",
    "CVE-2026-0891"
  ]
}

CVE-2025-14321 (GCVE-0-2025-14321)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:37 – Updated: 2026-04-13 14:25

Title

Use-after-free in the WebRTC: Signaling component

Summary

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-11 19:36 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1992760
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Igor Morgenstern

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T19:36:51.527373Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T20:36:32.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Igor Morgenstern"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:27.309Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1992760"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Use-after-free in the WebRTC: Signaling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14321",
    "datePublished": "2025-12-09T13:37:53.872Z",
    "dateReserved": "2025-12-09T13:37:53.205Z",
    "dateUpdated": "2026-04-13T14:25:27.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14322 (GCVE-0-2025-14322)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:37 – Updated: 2026-04-13 14:25

Title

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Summary

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-10 04:57 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

mozilla mitre root

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1996473
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.31 , ≤ 115.* (rpm) Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14322",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:18.096368Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-754",
                "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:57:08.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.31",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:29.901Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996473"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14322",
    "datePublished": "2025-12-09T13:37:55.159Z",
    "dateReserved": "2025-12-09T13:37:54.554Z",
    "dateUpdated": "2026-04-13T14:25:29.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14323 (GCVE-0-2025-14323)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:37 – Updated: 2026-04-13 14:25

Title

Privilege escalation in the DOM: Notifications component

Summary

Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-10 04:57 UTC

CWE

CWE-noinfo Not enough information

Assigner

mozilla mitre root

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1996555
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.31 , ≤ 115.* (rpm) Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

tiebuchen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:12.450670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:57:08.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.31",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "tiebuchen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:31.606Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996555"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Privilege escalation in the DOM: Notifications component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14323",
    "datePublished": "2025-12-09T13:37:56.358Z",
    "dateReserved": "2025-12-09T13:37:55.768Z",
    "dateUpdated": "2026-04-13T14:25:31.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14324 (GCVE-0-2025-14324)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:37 – Updated: 2026-04-13 14:25

Title

JIT miscompilation in the JavaScript Engine: JIT component

Summary

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-11 20:01 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mozilla mitre root

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1996840
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.31 , ≤ 115.* (rpm) Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Lingming Zhang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14324",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T20:01:17.895694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T20:03:10.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.31",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lingming Zhang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:33.489Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996840"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14324",
    "datePublished": "2025-12-09T13:37:57.533Z",
    "dateReserved": "2025-12-09T13:37:56.958Z",
    "dateUpdated": "2026-04-13T14:25:33.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14325 (GCVE-0-2025-14325)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:37 – Updated: 2026-04-13 14:25

Title

JIT miscompilation in the JavaScript Engine: JIT component

Summary

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-09 17:04 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1998050
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14325",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T17:04:03.255293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-07T15:11:20.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "zx"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:35.644Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1998050"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14325",
    "datePublished": "2025-12-09T13:37:58.843Z",
    "dateReserved": "2025-12-09T13:37:58.128Z",
    "dateUpdated": "2026-04-13T14:25:35.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14327 (GCVE-0-2025-14327)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-04-13 14:24

Title

Spoofing issue in the Downloads Panel component

Summary

Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-11 20:42 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1970743
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.7 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.7 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Caro Kann

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T20:42:08.839635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-290",
                "description": "CWE-290 Authentication Bypass by Spoofing",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T20:45:35.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.7",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.7",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Caro Kann"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7."
            }
          ],
          "value": "Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:24:13.332Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1970743"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Spoofing issue in the Downloads Panel component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14327",
    "datePublished": "2025-12-09T13:38:02.260Z",
    "dateReserved": "2025-12-09T13:38:01.463Z",
    "dateUpdated": "2026-04-13T14:24:13.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14328 (GCVE-0-2025-14328)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-04-13 14:25

Title

Privilege escalation in the Netmonitor component

Summary

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-10 04:57 UTC

CWE

CWE-noinfo Not enough information

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1996761
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Ameen Basha M K

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:17.009184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:57:07.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ameen Basha M K"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:37.532Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996761"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Privilege escalation in the Netmonitor component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14328",
    "datePublished": "2025-12-09T13:38:03.509Z",
    "dateReserved": "2025-12-09T13:38:02.928Z",
    "dateUpdated": "2026-04-13T14:25:37.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14329 (GCVE-0-2025-14329)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-04-13 14:25

Title

Privilege escalation in the Netmonitor component

Summary

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-10 04:57 UTC

CWE

CWE-noinfo Not enough information

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1997018
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

satrya wira yudha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14329",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:15.843111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:57:07.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "satrya wira yudha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:39.463Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1997018"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Privilege escalation in the Netmonitor component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14329",
    "datePublished": "2025-12-09T13:38:04.796Z",
    "dateReserved": "2025-12-09T13:38:04.223Z",
    "dateUpdated": "2026-04-13T14:25:39.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14330 (GCVE-0-2025-14330)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-04-13 14:25

Title

JIT miscompilation in the JavaScript Engine: JIT component

Summary

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-11 20:35 UTC

CWE

CWE-686 - Function Call With Incorrect Argument Type
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla mitre root

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1997503
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Rong Bao

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T20:35:46.407561Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-686",
                "description": "CWE-686 Function Call With Incorrect Argument Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T20:38:25.860Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Rong Bao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:41.657Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1997503"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14330",
    "datePublished": "2025-12-09T13:38:05.995Z",
    "dateReserved": "2025-12-09T13:38:05.412Z",
    "dateUpdated": "2026-04-13T14:25:41.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14331 (GCVE-0-2025-14331)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-04-13 14:25

Title

Same-origin policy bypass in the Request Handling component

Summary

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-09 16:59 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

mozilla mitre root

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2000218
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.31 , ≤ 115.* (rpm) Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.6 , ≤ 140.* (rpm) Unaffected: 146 , ≤ * (rpm)

Credits

Igor Morgenstern

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14331",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T16:59:10.319738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-09T16:59:50.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.31",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.6",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "146",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Igor Morgenstern"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
            }
          ],
          "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:25:43.540Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2000218"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"
        }
      ],
      "title": "Same-origin policy bypass in the Request Handling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14331",
    "datePublished": "2025-12-09T13:38:07.191Z",
    "dateReserved": "2025-12-09T13:38:06.607Z",
    "dateUpdated": "2026-04-13T14:25:43.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-1264 (CVE-2025-14321)

CVE-2025-14321 (GCVE-0-2025-14321)

CVE-2025-14322 (GCVE-0-2025-14322)

CVE-2025-14323 (GCVE-0-2025-14323)

CVE-2025-14324 (GCVE-0-2025-14324)

CVE-2025-14325 (GCVE-0-2025-14325)

CVE-2025-14327 (GCVE-0-2025-14327)

CVE-2025-14328 (GCVE-0-2025-14328)

CVE-2025-14329 (GCVE-0-2025-14329)

CVE-2025-14330 (GCVE-0-2025-14330)

CVE-2025-14331 (GCVE-0-2025-14331)

Tags

Sightings

Nomenclature

Related by attack behaviour