Skip to main content

Thunderbird CVE-2025-14331

MEDIUM
Origin Validation Error (CWE-346)
2025-12-09 security@mozilla.org
Authentication Bypass Mozilla Thunderbird
6.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malicious request
  2. Delivery
    Browser processes request via vulnerable handler
  3. Exploit
    SOP validation bypassed
  4. Execution
    Attacker reads cross-origin data
  5. Impact
    Leak sensitive information

Vulnerability Assessment

Weakness
CWE
CWE-346
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
Impact

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an easily exploitable remote vulnerability requiring no authentication or user action, typically concerning for a browser-based flaw. However, multiple risk signals create a discordant picture. The EPSS score of 0.04% (14th percentile) is exceptionally low, suggesting minimal exploitation probability in the wild despite technical exploitability. The confidentiality and integrity impacts are limited (C:L/I:L), not critical, and there is no availability impact (A:N). Notably, no KEV (CISA Known Exploited Vulnerability) status is indicated, and no public proof-of-concept exists. The moderate CVSS score of 6.5 combined with negligible EPSS probability suggests this is a real but narrow vulnerability-likely requiring specific conditions or victim interaction with malicious content-rather than a universally exploitable flaw. This represents a lower real-world priority than the CVSS score alone would indicate, though the SOP bypass nature warrants attention from defenders managing high-value targets.
Exploit ScenarioDerived

An attacker crafts a malicious web page or sends a specially designed network request that exploits improper origin validation in the browser's request handling logic, bypassing the Same-Origin Policy to read sensitive data (such as cookies, session tokens, or cross-origin resource contents) from a victim's browser session. The attack requires no authentication or user interaction beyond the victim visiting a malicious site or the request being triggered automatically by JavaScript, though the low EPSS score suggests real-world exploitation remains uncommon, possibly due to narrow triggering conditions or the need for specific victim configurations.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.

RemediationAI

Vendor-released patch: Firefox 146 (standard), Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146 (standard), and Thunderbird ESR 140.6. Users should immediately update to the patched versions via the automatic update mechanism in Firefox and Thunderbird, or by downloading the latest release from mozilla.org. Organizations managing Firefox/Thunderbird deployments should prioritize ESR branch updates (115.31 or 140.6) depending on their locked ESR track. Detailed patch information and security context are available in Mozilla security advisories at https://www.mozilla.org/security/advisories/mfsa2025-92/, https://www.mozilla.org/security/advisories/mfsa2025-93/, https://www.mozilla.org/security/advisories/mfsa2025-94/, https://www.mozilla.org/security/advisories/mfsa2025-95/, and https://www.mozilla.org/security/advisories/mfsa2025-96/.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the Request Handling component of Mozilla's browser engines (Firefox/Thunderbird), which implements the Same-Origin Policy (SOP)-a fundamental web security boundary that prevents scripts and requests from one origin from accessing resources of another origin. CWE-346 (Origin Validation Error) indicates the root cause is improper enforcement of origin checks during request processing. The affected products span both release and Extended Support Release (ESR) branches across multiple versions, as indicated by the CPE strings covering Firefox and Thunderbird in both standard and ESR variants. The network vector with no privilege requirements and no user interaction suggests the bypass can be triggered through crafted network requests or malicious web content.

Know when Thunderbird gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE MEDIUM
Red Hat 6.1 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

DescriptionNVD

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)NVD

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

More in Thunderbird

View all
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-346 – Origin Validation Error

View all
CVE-2015-4495 HIGH POC
8.8
CVE-2025-34291 CRITICAL POC
9.4
CVE-2020-16952 HIGH POC
8.6
CVE-2022-50925 CRITICAL POC
9.8
CVE-2024-25124 CRITICAL POC
9.8
CVE-2023-29711 CRITICAL POC
9.8
CVE-2023-33443 CRITICAL POC
9.8
CVE-2023-29728 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.2 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:23034 ADVISORY https://access.redhat.com/errata/RHSA-2025:23035 ADVISORY https://access.redhat.com/errata/RHSA-2025:23128 ADVISORY https://access.redhat.com/errata/RHSA-2025:23856 ADVISORY https://access.redhat.com/errata/RHSA-2026:0003 ADVISORY https://access.redhat.com/errata/RHSA-2026:0004 ADVISORY https://access.redhat.com/errata/RHSA-2026:0005 ADVISORY https://access.redhat.com/errata/RHSA-2026:0006 ADVISORY https://access.redhat.com/errata/RHSA-2026:0007 ADVISORY https://access.redhat.com/errata/RHSA-2026:0013 ADVISORY https://access.redhat.com/errata/RHSA-2026:0014 ADVISORY https://access.redhat.com/errata/RHSA-2026:0015 ADVISORY https://access.redhat.com/errata/RHSA-2026:0016 ADVISORY https://access.redhat.com/errata/RHSA-2026:0017 ADVISORY https://access.redhat.com/errata/RHSA-2026:0018 ADVISORY https://access.redhat.com/errata/RHSA-2026:0019 ADVISORY https://access.redhat.com/errata/RHSA-2026:0020 ADVISORY https://access.redhat.com/errata/RHSA-2026:0021 ADVISORY https://access.redhat.com/errata/RHSA-2026:0022 ADVISORY https://access.redhat.com/errata/RHSA-2026:0023 ADVISORY https://access.redhat.com/errata/RHSA-2026:0024 ADVISORY https://access.redhat.com/errata/RHSA-2026:0025 ADVISORY https://access.redhat.com/errata/RHSA-2026:0026 ADVISORY https://access.redhat.com/errata/RHSA-2026:0124 ADVISORY https://access.redhat.com/errata/RHSA-2026:0127 ADVISORY https://vuldb.com/vuln/335154 ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-92/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-93/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-94/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-95/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-96/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4396/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4397/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4424/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20031/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=2000218

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy