CVE-2025-14323

Vulnerability

Overview

CVE-2025-14323 is a privilege escalation vulnerability in the DOM: Notifications component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to bypass security restrictions and obtain higher privileges within the browser or application context. The root cause lies in improper handling of notifications, leading to an unexpected privilege escalation [1][2].

Exploitation

The vulnerability can be exploited by a malicious web page in Firefox, or in Thunderbird when scripting is enabled. However, in Thunderbird, scripting is disabled by default when reading mail, so exploitation through email is not possible [1]. The attack vector likely involves a crafted notification or interaction with the notification system, though specific trigger details are not publicly disclosed.

Impact

Successful exploitation could allow an attacker to gain elevated privileges, potentially leading to further compromise such as sandbox escape or arbitrary code execution, depending on the affected version and context. The CVSS v3 score is 8.8, indicating high severity.

Mitigation

Mozilla has fixed this issue in Firefox 146, Firefox ESR 140.6, Firefox ESR 115.31, Thunderbird 146, and Thunderbird 140.6. Users are advised to update to the latest versions as soon as possible. No workarounds are currently available [1][2][3][4].