Loading vulnerability…
Same-origin policy bypass in Mozilla Firefox and Thunderbird Request Handling
CVE-2025-14331 is a same-origin policy bypass in the Request Handling component of Mozilla Firefox and Thunderbird. The flaw allows origin-based security restrictions to be bypassed, potentially exposing information across origin boundaries. Mozilla rates its impact as moderate. It was fixed in Firefox 146, Firefox ESR 115.31 and 140.6, and Thunderbird 146 and 140.6. The specific vulnerable function and triggering request conditions are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can violate same-origin isolation and potentially permit unauthorized access to cross-origin information. The precise scope of accessible data is not specified. Arbitrary code execution, sandbox escape, and privilege escalation are not established consequences of this individual vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are applied, reduce exposure to untrusted web content and restrict Thunderbird use to trusted content, avoiding suspicious messages and attachments. These precautions are not a substitute for patching.
Patch, then assume compromise.
Upgrade to Firefox 146 or later, Firefox ESR 115.31 or 140.6 or later within the corresponding supported release branch, or Thunderbird 146 or 140.6 or later, as applicable. For distribution-managed installations, apply the vendor security package containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.