CVE-2025-14328

Vulnerability

Overview

CVE-2025-14328 is a privilege escalation vulnerability in the escalation vulnerability in the Netmonitor component of Mozilla Firefox and Thunderbird. The root cause is a flaw in the Netmonitor component that allows an attacker to escalate privileges within the application [1][2]. The vulnerability was reported by Ameen Basha M K and has been assigned a high severity rating with a CVSS v3 score of 8.8 [1][2].

Exploitation and

Attack Surface

The vulnerability can be exploited in browser or browser-like contexts, but in the Thunderbird product, scripting is disabled when reading email, which prevents exploitation through email alone [1][3]. However, in Firefox or other browser contexts, an attacker could potentially trigger the privilege escalation by convincing a user to visit a malicious page or by exploiting another vulnerability to execute code in the browser's context [1][2].

Impact

Successful exploitation of this vulnerability could allow an attacker to gain elevated privileges within the affected application, potentially leading to further compromise of the system [1][2]. The impact is considered high, and the vulnerability is part of a set of multiple security fixes released by Mozilla on December 9, 2025 [1][1][2].

Mitigation

Mozilla has addressed this vulnerability in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6 [1][2][3][4]. Users are strongly advised to update their software to the latest versions to mitigate the risk. No workarounds are mentioned in the advisories.