Loading vulnerability…
Privilege Escalation in Mozilla Firefox and Thunderbird DOM Notifications
CVE-2025-14323 is a high-severity privilege escalation vulnerability in the DOM: Notifications component used by Mozilla Firefox and Thunderbird. It affects Firefox before 146, Firefox ESR before 115.31 in the 115 ESR branch and before 140.6 in the 140 ESR branch, and Thunderbird releases preceding the fixes in 146 and 140.6. Exploitation can allow an attacker to gain elevated privileges. The specific vulnerable function, underlying implementation defect, and privilege boundary crossed are not publicly detailed in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in privilege escalation through the DOM Notifications component. The vulnerability is rated high severity, with a reported CVSS 3.1 score of 8.8 and high confidentiality, integrity, and availability impacts. Operating-system privilege escalation, arbitrary code execution, and sandbox escape are not individually established for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is established. Until updates are deployed, restrict exposure to untrusted web content and limit use of affected applications where feasible. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade to Firefox 146 or later, Firefox ESR 115.31 or later within the 115 ESR branch, or Firefox ESR 140.6 or later within the 140 ESR branch. Upgrade Thunderbird to 146 or later, or Thunderbird ESR to 140.6 or later. For distribution-managed installations, apply the corresponding vendor security packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.