CVE-2025-14327
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
AnalysisAI
Downloads Panel in Mozilla Firefox and Thunderbird allows remote spoofing attacks enabling integrity compromise without authentication. Affects Firefox <146, Thunderbird <146, Firefox ESR <140.7, and Thunderbird ESR <140.7. The authentication bypass flaw (CWE-290) permits network-based attackers to manipulate download information displayed to users with low attack complexity and no user interaction required. Despite CVSS 7.5 (High), EPSS score of 0.02% (3rd percentile) indicates minimal real-world exploitation likelihood. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability targets the Downloads Panel component in Mozilla's Firefox browser and Thunderbird email client, specifically affecting the user interface elements that display download status and metadata. Classified as CWE-290 (Authentication Issues), this represents an authentication bypass weakness where the application fails to properly validate the authenticity or source integrity of download-related information. The CVSS vector indicates network-accessible exploitation (AV:N) without authentication requirements (PR:N), suggesting the Downloads Panel processes network-sourced data without sufficient verification of its origin or integrity. The affected products identified via CPE strings include all Mozilla Firefox and Thunderbird installations across platforms prior to the patched versions. The spoofing mechanism likely allows attackers to present falsified download sources, filenames, or security indicators that could deceive users into trusting malicious content.
RemediationAI
Vendor-released patches are available through standard Mozilla update channels. Upgrade Firefox to version 146 or later for standard release users, or Firefox ESR to version 140.7 or later for enterprise deployments requiring extended support cycles (advisory: https://www.mozilla.org/security/advisories/mfsa2025-92/). Thunderbird users should upgrade to version 146 or later (standard channel) or Thunderbird ESR 140.7 or later (ESR channel), as documented in advisory MFSA2025-95 (https://www.mozilla.org/security/advisories/mfsa2025-95/). Firefox and Thunderbird auto-update mechanisms will deliver patches automatically for users with updates enabled. Enterprise administrators managing large deployments should prioritize updates through existing software distribution frameworks. No workarounds are documented; patching is the only confirmed remediation. Users should verify post-update versions through Help > About menus in respective applications.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today