Same-Origin Policy Bypass in Firefox Browser by Mozilla
CVE-2025-14331

6.5MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
9 December 2025

What is CVE-2025-14331?

A vulnerability has been identified in the Request Handling component of the Firefox browser, allowing a circumvention of the same-origin policy. This flaw affects specific versions of Firefox and its Extended Support Release (ESR) variants, potentially exposing users to security risks by allowing malicious websites to access sensitive data from other domains. Affected versions include Firefox prior to 146, and both Firefox ESR versions below 115.31 and 140.6. Users are strongly advised to upgrade to the latest versions to mitigate potential exploit risks.

Affected Version(s)

Firefox < 146

Firefox ESR < 115.31

Firefox ESR < 140.6

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2000218
https://www.mozilla.org/security/advisories/mfsa2025-92/
https://www.mozilla.org/security/advisories/mfsa2025-93/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Igor Morgenstern
JSON
.
CVE-2025-14331 : Same-Origin Policy Bypass in Firefox Browser by Mozilla