Sandbox Escape in Firefox due to Boundary Condition Flaws
CVE-2025-14322

8HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
9 December 2025

What is CVE-2025-14322?

A vulnerability in the CanvasWebGL component of Firefox allows for a sandbox escape due to incorrect boundary conditions. This flaw can potentially enable attackers to execute arbitrary code outside the intended security constraints of the browser. Users of affected versions should apply updates immediately to mitigate the risk, as it compromises the isolation meant to protect users from malicious content.

Affected Version(s)

Firefox < 146

Firefox ESR < 115.31

Firefox ESR < 140.6

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1996473
https://www.mozilla.org/security/advisories/mfsa2025-92/
https://www.mozilla.org/security/advisories/mfsa2025-93/

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oskar L
JSON
.
CVE-2025-14322 : Sandbox Escape in Firefox due to Boundary Condition Flaws