{"id":"CVE-2025-14331","title":"Same-origin policy bypass in the Request Handling component","summary":"Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-346"],"vendor":"mozilla","product":"firefox","affected":["firefox < 115.31.0","firefox < 146.0","firefox >= 116.0, < 140.6.0","thunderbird < 140.6.0","thunderbird < 146.0"],"patched":["firefox 140.6.0","thunderbird 146.0"],"published":"2025-12-09","updated":"2026-10-07","sourceUpdated":"2026-10-07T20:10:01.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14331","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2000218","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-92/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-93/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-94/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-95/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-96/","label":"security@mozilla.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14331.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-14331"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2420512"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14331"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14331"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14331"},{"url":"https://access.redhat.com/errata/RHSA-2026:0007"},{"url":"https://access.redhat.com/errata/RHSA-2026:0127"},{"url":"https://access.redhat.com/errata/RHSA-2026:0124"},{"url":"https://access.redhat.com/errata/RHSA-2025:23035"},{"url":"https://access.redhat.com/errata/RHSA-2026:0025"},{"url":"https://access.redhat.com/errata/RHSA-2025:23128"},{"url":"https://access.redhat.com/errata/RHSA-2026:0026"},{"url":"https://access.redhat.com/errata/RHSA-2026:0005"},{"url":"https://access.redhat.com/errata/RHSA-2026:0024"},{"url":"https://access.redhat.com/errata/RHSA-2026:0006"},{"url":"https://access.redhat.com/errata/RHSA-2026:0023"},{"url":"https://access.redhat.com/errata/RHSA-2026:0014"},{"url":"https://access.redhat.com/errata/RHSA-2026:0022"},{"url":"https://access.redhat.com/errata/RHSA-2026:0015"},{"url":"https://access.redhat.com/errata/RHSA-2026:0021"},{"url":"https://access.redhat.com/errata/RHSA-2026:0018"},{"url":"https://access.redhat.com/errata/RHSA-2026:0020"},{"url":"https://access.redhat.com/errata/RHSA-2026:0017"},{"url":"https://access.redhat.com/errata/RHSA-2026:0019"},{"url":"https://access.redhat.com/errata/RHSA-2026:0016"},{"url":"https://access.redhat.com/errata/RHSA-2026:0004"},{"url":"https://access.redhat.com/errata/RHSA-2026:0013"},{"url":"https://access.redhat.com/errata/RHSA-2026:0003"},{"url":"https://access.redhat.com/errata/RHSA-2025:23034"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00187,"epssPercentile":0.08192,"ingestedAt":"2026-09-30T17:13:20.757Z","scores":{"nvd":6.5,"vendor":6.1},"slug":"CVE-2025-14331","body":"## Overview\n\nSame-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.\n\n## Affected\n\n- `firefox < 115.31.0`\n- `firefox < 146.0`\n- `firefox >= 116.0, < 140.6.0`\n- `thunderbird < 140.6.0`\n- `thunderbird < 146.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `firefox 140.6.0`\n- `thunderbird 146.0`\n\n## Vendor advisories\n\n- **RHSA-2026:0007** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0007)\n- **RHSA-2026:0127** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0127)\n- **RHSA-2026:0124** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0124)\n- **RHSA-2025:23035** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23035)\n- **RHSA-2026:0025** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0025)\n- **RHSA-2025:23128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23128)\n- **RHSA-2026:0026** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0026)\n- **RHSA-2026:0005** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0005)\n- **RHSA-2026:0024** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0024)\n- **RHSA-2026:0006** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0006)\n- **RHSA-2026:0023** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0023)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14331.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}