Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

zetlyn/cve-nvd vulnerability cve CVE-2025-14331 cpe cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* cpe cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* cpe cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* cpe cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* known 2025-12-09

https://nvd.nist.gov/vuln/detail/CVE-2025-14331

Properties

cvss	6.5 receipt Source NVD Its words `6.5` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "115.", "status": "unaffected", "version": "115.31", "versionType": "rpm" }, { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] }, { "product": "Thunderbird", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "22C1C512-2D57-4BCB-ABE2-5CA41F354AA1", "versionEndExcluding": "115.31.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::-:::", "matchCriteriaId": "3EF4CBBC-DCB5-4540-8B8A-91DA759ED631", "versionEndExcluding": "146.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "AB211B63-E6CF-4D11-BCEE-CF495FA0B0EF", "versionEndExcluding": "140.6.0", "versionStartIncluding": "116.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::esr:::", "matchCriteriaId": "F04F8674-52CC-4217-B94A-8C5E80C5B996", "versionEndExcluding": "140.6.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::-:::", "matchCriteriaId": "1CB46BC7-512D-45BF-BCF4-73FDDF94DBAF", "versionEndExcluding": "146.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6." }, { "lang": "es", "value": "Elusión de la política del mismo origen en el componente de gestión de solicitudes. Esta vulnerabilidad afecta a Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, y Thunderbird < 140.6." } ], "id": "CVE-2025-14331", "lastModified": "2026-09-30T17:10:00.187", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-14331", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-12-09T16:59:10.319738Z", "version": "2.0.3" } } ] }, "published": "2025-12-09T16:17:40.773", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking", "Permissions Required" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2000218" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
product	Firefox receipt Source NVD Its words `Firefox` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "115.", "status": "unaffected", "version": "115.31", "versionType": "rpm" }, { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] }, { "product": "Thunderbird", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "22C1C512-2D57-4BCB-ABE2-5CA41F354AA1", "versionEndExcluding": "115.31.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::-:::", "matchCriteriaId": "3EF4CBBC-DCB5-4540-8B8A-91DA759ED631", "versionEndExcluding": "146.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "AB211B63-E6CF-4D11-BCEE-CF495FA0B0EF", "versionEndExcluding": "140.6.0", "versionStartIncluding": "116.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::esr:::", "matchCriteriaId": "F04F8674-52CC-4217-B94A-8C5E80C5B996", "versionEndExcluding": "140.6.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::-:::", "matchCriteriaId": "1CB46BC7-512D-45BF-BCF4-73FDDF94DBAF", "versionEndExcluding": "146.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6." }, { "lang": "es", "value": "Elusión de la política del mismo origen en el componente de gestión de solicitudes. Esta vulnerabilidad afecta a Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, y Thunderbird < 140.6." } ], "id": "CVE-2025-14331", "lastModified": "2026-09-30T17:10:00.187", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-14331", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-12-09T16:59:10.319738Z", "version": "2.0.3" } } ] }, "published": "2025-12-09T16:17:40.773", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking", "Permissions Required" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2000218" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
status	Modified receipt Source NVD Its words `Modified` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "115.", "status": "unaffected", "version": "115.31", "versionType": "rpm" }, { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] }, { "product": "Thunderbird", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "22C1C512-2D57-4BCB-ABE2-5CA41F354AA1", "versionEndExcluding": "115.31.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::-:::", "matchCriteriaId": "3EF4CBBC-DCB5-4540-8B8A-91DA759ED631", "versionEndExcluding": "146.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "AB211B63-E6CF-4D11-BCEE-CF495FA0B0EF", "versionEndExcluding": "140.6.0", "versionStartIncluding": "116.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::esr:::", "matchCriteriaId": "F04F8674-52CC-4217-B94A-8C5E80C5B996", "versionEndExcluding": "140.6.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::-:::", "matchCriteriaId": "1CB46BC7-512D-45BF-BCF4-73FDDF94DBAF", "versionEndExcluding": "146.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6." }, { "lang": "es", "value": "Elusión de la política del mismo origen en el componente de gestión de solicitudes. Esta vulnerabilidad afecta a Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, y Thunderbird < 140.6." } ], "id": "CVE-2025-14331", "lastModified": "2026-09-30T17:10:00.187", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-14331", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-12-09T16:59:10.319738Z", "version": "2.0.3" } } ] }, "published": "2025-12-09T16:17:40.773", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking", "Permissions Required" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2000218" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
vendor	Mozilla receipt Source NVD Its words `Mozilla` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "115.", "status": "unaffected", "version": "115.31", "versionType": "rpm" }, { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] }, { "product": "Thunderbird", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "140.", "status": "unaffected", "version": "140.6", "versionType": "rpm" }, { "lessThanOrEqual": "", "status": "unaffected", "version": "146", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "22C1C512-2D57-4BCB-ABE2-5CA41F354AA1", "versionEndExcluding": "115.31.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::-:::", "matchCriteriaId": "3EF4CBBC-DCB5-4540-8B8A-91DA759ED631", "versionEndExcluding": "146.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:firefox:::::esr:::", "matchCriteriaId": "AB211B63-E6CF-4D11-BCEE-CF495FA0B0EF", "versionEndExcluding": "140.6.0", "versionStartIncluding": "116.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::esr:::", "matchCriteriaId": "F04F8674-52CC-4217-B94A-8C5E80C5B996", "versionEndExcluding": "140.6.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:mozilla:thunderbird:::::-:::", "matchCriteriaId": "1CB46BC7-512D-45BF-BCF4-73FDDF94DBAF", "versionEndExcluding": "146.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6." }, { "lang": "es", "value": "Elusión de la política del mismo origen en el componente de gestión de solicitudes. Esta vulnerabilidad afecta a Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, y Thunderbird < 140.6." } ], "id": "CVE-2025-14331", "lastModified": "2026-09-30T17:10:00.187", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-14331", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-12-09T16:59:10.319738Z", "version": "2.0.3" } } ] }, "published": "2025-12-09T16:17:40.773", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking", "Permissions Required" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2000218" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-346" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }

Text

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Elusión de la política del mismo origen en el componente de gestión de solicitudes. Esta vulnerabilidad afecta a Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, y Thunderbird < 140.6.