--- id: CVE-2025-14323 title: 'Privilege escalation in the DOM: Notifications component' summary: >- Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' vendor: mozilla product: firefox affected: - firefox < 115.31.0 - firefox < 146.0 - 'firefox >= 116.0, < 140.6.0' - thunderbird < 140.6.0 - thunderbird < 146.0 patched: - firefox 140.6.0 - thunderbird 146.0 published: '2025-12-09' updated: '2026-10-07' sourceUpdated: '2026-10-07T20:10:01.970' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14323' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=1996555' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-92/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-93/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-94/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-95/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-96/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14323.json - url: 'https://access.redhat.com/security/cve/CVE-2025-14323' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2420513' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-14323' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14323' - url: 'https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14323' - url: 'https://access.redhat.com/errata/RHSA-2026:0007' - url: 'https://access.redhat.com/errata/RHSA-2026:0127' - url: 'https://access.redhat.com/errata/RHSA-2026:0124' - url: 'https://access.redhat.com/errata/RHSA-2025:23035' - url: 'https://access.redhat.com/errata/RHSA-2026:0025' - url: 'https://access.redhat.com/errata/RHSA-2025:23128' - url: 'https://access.redhat.com/errata/RHSA-2026:0026' - url: 'https://access.redhat.com/errata/RHSA-2026:0005' - url: 'https://access.redhat.com/errata/RHSA-2026:0024' - url: 'https://access.redhat.com/errata/RHSA-2026:0006' - url: 'https://access.redhat.com/errata/RHSA-2026:0023' - url: 'https://access.redhat.com/errata/RHSA-2026:0014' - url: 'https://access.redhat.com/errata/RHSA-2026:0022' - url: 'https://access.redhat.com/errata/RHSA-2026:0015' - url: 'https://access.redhat.com/errata/RHSA-2026:0021' - url: 'https://access.redhat.com/errata/RHSA-2026:0018' - url: 'https://access.redhat.com/errata/RHSA-2026:0020' - url: 'https://access.redhat.com/errata/RHSA-2026:0017' - url: 'https://access.redhat.com/errata/RHSA-2026:0019' - url: 'https://access.redhat.com/errata/RHSA-2026:0016' - url: 'https://access.redhat.com/errata/RHSA-2026:0004' - url: 'https://access.redhat.com/errata/RHSA-2026:0013' - url: 'https://access.redhat.com/errata/RHSA-2026:0003' - url: 'https://access.redhat.com/errata/RHSA-2025:23034' tags: - nvd - csaf - vex - red-hat epss: 0.00415 epssPercentile: 0.35582 ingestedAt: '2026-09-30T17:13:20.754Z' scores: nvd: 8.8 vendor: 7.5 cwe: - CWE-266 --- ## Overview Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. ## Affected - `firefox < 115.31.0` - `firefox < 146.0` - `firefox >= 116.0, < 140.6.0` - `thunderbird < 140.6.0` - `thunderbird < 146.0` ## Remediation Upgrade past the affected range: - `firefox 140.6.0` - `thunderbird 146.0` ## Vendor advisories - **RHSA-2026:0007** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0007) - **RHSA-2026:0127** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0127) - **RHSA-2026:0124** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0124) - **RHSA-2025:23035** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23035) - **RHSA-2026:0025** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0025) - **RHSA-2025:23128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23128) - **RHSA-2026:0026** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0026) - **RHSA-2026:0005** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0005) - **RHSA-2026:0024** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0024) - **RHSA-2026:0006** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0006) - **RHSA-2026:0023** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0023) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14323.json)