Loading vulnerability…
Sandbox Escape in Mozilla Firefox and Thunderbird CanvasWebGL
CVE-2025-14322 is a high-severity sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird. Successful exploitation allows an attacker to cross sandbox security boundaries, potentially compromising confidentiality and integrity outside the sandbox. Affected releases include Firefox before 146, Firefox ESR releases before 115.31 or 140.6 in their respective branches, and Thunderbird releases before the corresponding fixed versions 146 and 140.6. The precise vulnerable function and boundary-check failure are not publicly specified in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses sandbox isolation and can expose resources outside the affected sandbox to unauthorized access or modification. The vulnerability is rated high severity, with a reported CVSS 3.1 score of 8.0 and confidentiality and integrity impacts. Standalone arbitrary code execution or full host compromise is not established for this vulnerability specifically.
If you can’t patch tonight, do this now.
Until updates are installed, restrict exposure to untrusted web content and limit Thunderbird use to trusted messages and attachments. Disabling WebGL where operationally feasible may reduce exposure to the affected component, but is not established as a complete workaround. Apply least privilege and endpoint exploit protections as defense-in-depth measures.
Patch, then assume compromise.
Upgrade to Firefox 146 or later; Firefox ESR 115.31 or later in the 115 branch, or 140.6 or later in the 140 branch; or Thunderbird 146 or 140.6 or later in the corresponding release branch. For distribution-managed installations, install the vendor's security-updated packages containing these fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.