Loading vulnerability…
Privilege Escalation in Mozilla Netmonitor
CVE-2025-14329 is a privilege escalation vulnerability in the Netmonitor component of Mozilla Firefox and Thunderbird. It affects Firefox versions before 146, Firefox ESR versions before 140.6, and affected Thunderbird releases preceding the fixes in versions 146 and 140.6. Successful exploitation can grant an attacker elevated privileges within the affected application. The precise vulnerable function and underlying implementation flaw are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can escalate privileges within the affected application, potentially compromising application security boundaries and protected data. The resulting privilege level is unspecified; operating-system privilege escalation, arbitrary code execution, and sandbox escape are not independently established for this CVE.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround is established. Until patched, restrict exposure to untrusted web and email content and apply least privilege to limit potential consequences. These defense-in-depth measures are not substitutes for the security update.
Patch, then assume compromise.
Upgrade to Firefox 146 or later, Firefox ESR 140.6 or later, Thunderbird 146 or later, or Thunderbird ESR 140.6 or later, as appropriate for the installed release channel. Distribution-managed installations should apply the corresponding vendor security package updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.