--- id: CVE-2025-14331 title: Same-origin policy bypass in the Request Handling component summary: >- Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N' cwe: - CWE-346 vendor: mozilla product: firefox affected: - firefox < 115.31.0 - firefox < 146.0 - 'firefox >= 116.0, < 140.6.0' - thunderbird < 140.6.0 - thunderbird < 146.0 patched: - firefox 140.6.0 - thunderbird 146.0 published: '2025-12-09' updated: '2026-10-07' sourceUpdated: '2026-10-07T20:10:01.970' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14331' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2000218' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-92/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-93/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-94/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-95/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2025-96/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14331.json - url: 'https://access.redhat.com/security/cve/CVE-2025-14331' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2420512' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-14331' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14331' - url: 'https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14331' - url: 'https://access.redhat.com/errata/RHSA-2026:0007' - url: 'https://access.redhat.com/errata/RHSA-2026:0127' - url: 'https://access.redhat.com/errata/RHSA-2026:0124' - url: 'https://access.redhat.com/errata/RHSA-2025:23035' - url: 'https://access.redhat.com/errata/RHSA-2026:0025' - url: 'https://access.redhat.com/errata/RHSA-2025:23128' - url: 'https://access.redhat.com/errata/RHSA-2026:0026' - url: 'https://access.redhat.com/errata/RHSA-2026:0005' - url: 'https://access.redhat.com/errata/RHSA-2026:0024' - url: 'https://access.redhat.com/errata/RHSA-2026:0006' - url: 'https://access.redhat.com/errata/RHSA-2026:0023' - url: 'https://access.redhat.com/errata/RHSA-2026:0014' - url: 'https://access.redhat.com/errata/RHSA-2026:0022' - url: 'https://access.redhat.com/errata/RHSA-2026:0015' - url: 'https://access.redhat.com/errata/RHSA-2026:0021' - url: 'https://access.redhat.com/errata/RHSA-2026:0018' - url: 'https://access.redhat.com/errata/RHSA-2026:0020' - url: 'https://access.redhat.com/errata/RHSA-2026:0017' - url: 'https://access.redhat.com/errata/RHSA-2026:0019' - url: 'https://access.redhat.com/errata/RHSA-2026:0016' - url: 'https://access.redhat.com/errata/RHSA-2026:0004' - url: 'https://access.redhat.com/errata/RHSA-2026:0013' - url: 'https://access.redhat.com/errata/RHSA-2026:0003' - url: 'https://access.redhat.com/errata/RHSA-2025:23034' tags: - nvd - csaf - vex - red-hat epss: 0.00187 epssPercentile: 0.08192 ingestedAt: '2026-09-30T17:13:20.757Z' scores: nvd: 6.5 vendor: 6.1 --- ## Overview Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. ## Affected - `firefox < 115.31.0` - `firefox < 146.0` - `firefox >= 116.0, < 140.6.0` - `thunderbird < 140.6.0` - `thunderbird < 146.0` ## Remediation Upgrade past the affected range: - `firefox 140.6.0` - `thunderbird 146.0` ## Vendor advisories - **RHSA-2026:0007** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0007) - **RHSA-2026:0127** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0127) - **RHSA-2026:0124** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0124) - **RHSA-2025:23035** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23035) - **RHSA-2026:0025** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0025) - **RHSA-2025:23128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23128) - **RHSA-2026:0026** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0026) - **RHSA-2026:0005** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0005) - **RHSA-2026:0024** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0024) - **RHSA-2026:0006** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0006) - **RHSA-2026:0023** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0023) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14331.json)