{"id":"CVE-2025-14327","title":"Spoofing issue in the Downloads Panel component","summary":"Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-290"],"vendor":"mozilla","product":"firefox","affected":["firefox < 146.0","thunderbird < 146.0"],"patched":["firefox 146.0","thunderbird 146.0"],"published":"2025-12-09","updated":"2026-10-07","sourceUpdated":"2026-10-07T20:10:01.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14327","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1970743","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-92/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-95/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-03/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-05/","label":"security@mozilla.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14327.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-14327"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2420507"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14327"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14327"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2025-14327"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2025-14327"},{"url":"https://access.redhat.com/errata/RHSA-2026:2231"},{"url":"https://access.redhat.com/errata/RHSA-2026:2271"},{"url":"https://access.redhat.com/errata/RHSA-2026:2286"},{"url":"https://access.redhat.com/errata/RHSA-2026:0667"},{"url":"https://access.redhat.com/errata/RHSA-2026:2220"},{"url":"https://access.redhat.com/errata/RHSA-2026:2074"},{"url":"https://access.redhat.com/errata/RHSA-2026:1471"},{"url":"https://access.redhat.com/errata/RHSA-2026:2073"},{"url":"https://access.redhat.com/errata/RHSA-2026:1461"},{"url":"https://access.redhat.com/errata/RHSA-2026:2070"},{"url":"https://access.redhat.com/errata/RHSA-2026:1487"},{"url":"https://access.redhat.com/errata/RHSA-2026:2069"},{"url":"https://access.redhat.com/errata/RHSA-2026:1462"},{"url":"https://access.redhat.com/errata/RHSA-2026:2047"},{"url":"https://access.redhat.com/errata/RHSA-2026:1413"},{"url":"https://access.redhat.com/errata/RHSA-2026:2044"},{"url":"https://access.redhat.com/errata/RHSA-2026:1415"},{"url":"https://access.redhat.com/errata/RHSA-2026:2041"},{"url":"https://access.redhat.com/errata/RHSA-2026:1414"},{"url":"https://access.redhat.com/errata/RHSA-2026:2043"},{"url":"https://access.redhat.com/errata/RHSA-2026:1320"},{"url":"https://access.redhat.com/errata/RHSA-2026:0694"},{"url":"https://access.redhat.com/errata/RHSA-2026:0924"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00379,"epssPercentile":0.31668,"ingestedAt":"2026-09-30T17:13:20.755Z","scores":{"nvd":7.5,"vendor":7.1},"slug":"CVE-2025-14327","body":"## Overview\n\nSpoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.\n\n## Affected\n\n- `firefox < 146.0`\n- `thunderbird < 146.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `firefox 146.0`\n- `thunderbird 146.0`\n\n## Vendor advisories\n\n- **RHSA-2026:2231** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2231)\n- **RHSA-2026:2271** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2271)\n- **RHSA-2026:2286** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2286)\n- **RHSA-2026:0667** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0667)\n- **RHSA-2026:2220** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2220)\n- **RHSA-2026:2074** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2074)\n- **RHSA-2026:1471** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1471)\n- **RHSA-2026:2073** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2073)\n- **RHSA-2026:1461** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1461)\n- **RHSA-2026:2070** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2070)\n- **RHSA-2026:1487** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1487)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14327.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}