Loading vulnerability…
Downloads Panel Spoofing in Mozilla Firefox and Thunderbird
CVE-2025-14327 is a user-interface spoofing vulnerability in the Downloads Panel component of Mozilla Firefox and Thunderbird. The flaw can misrepresent download-related information or actions, potentially misleading users. Mozilla rates the vulnerability as moderate impact. It is fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird ESR 140.7. The precise triggering input and underlying implementation defect are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can undermine the integrity of information presented in the Downloads Panel, potentially causing users to trust misleading download-related information or actions. The associated CVSS v3.0 vector assigns high integrity impact and no confidentiality or availability impact. Arbitrary code execution, privilege escalation, and data disclosure are not established consequences of this specific vulnerability.
If you can’t patch tonight, do this now.
Until updates can be installed, restrict exposure to untrusted web content and downloads. Where feasible, use enterprise policies to limit downloads and web filtering to reduce exposure to malicious content. These measures reduce exposure but are not a confirmed workaround for the underlying flaw.
Patch, then assume compromise.
Upgrade to Firefox 146 or later, Thunderbird 146 or later, Firefox ESR 140.7 or later, or Thunderbird ESR 140.7 or later, as applicable. For Debian bookworm and trixie, install the security-updated firefox-esr or thunderbird packages at version 140.7.0esr-1~deb12u1 or 140.7.0esr-1~deb13u1, respectively; Debian Thunderbird package versions include the epoch prefix 1:.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.