Same-Origin Policy Bypass in Firefox Notifications Component

CVE-2025-13017

What is CVE-2025-13017?

A security vulnerability in the Firefox web browser has been identified that allows for a bypass of the same-origin policy specifically in the DOM Notifications component. This issue affects versions of Firefox prior to 145 and Firefox Extended Support Release (ESR) versions prior to 140.5. Exploitation of this vulnerability could allow malicious websites to access sensitive information across different origins, potentially compromising user privacy and security.

References