CVE-2025-14329
Description
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Privilege escalation in Firefox/Thunderbird Netmonitor component allows attackers to gain elevated privileges; fixed in Firefox 146, ESR 140.6, Thunderbird 146/140.6.
CVE-2025-14329 is a privilege escalation vulnerability in the Netmonitor component of Firefox and Thunderbird. The Netmonitor is part of the browser's developer tools, and the flaw allows an attacker to bypass security restrictions and gain elevated privileges within the browser context [1][2].
The vulnerability can be triggered by a malicious webpage or in browser-like contexts. In Thunderbird, scripting is disabled when reading email, so exploitation via email is unlikely, but it remains a risk in browser contexts [1][3]. An attacker would need to convince a user to interact with a crafted page or use the developer tools.
Successful exploitation could allow an attacker to escalate privileges, potentially leading to arbitrary code execution or sandbox escape. The CVSS score is 8.8 (High) [2].
Mozilla has addressed this vulnerability in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Users are advised to update to these versions [1][2][3][4].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
7cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <146.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.6.0
- (no CPE)range: <146
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*range: <146.0
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*range: <140.6.0
- (no CPE)range: <146
- Range: <140.6
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.mozilla.org/security/advisories/mfsa2025-92/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-94/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-95/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-96/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions Required
News mentions
0No linked articles in our index yet.