CVE-2025-13019
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Nov 11, 2025
CISA due date
—
The record
Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | firefox | 0 | 140.5.0-2.el10_1 |
| AlmaLinux:10 | thunderbird | 0 | 140.5.0-2.el10_1 |
| AlmaLinux:8 | firefox | 0 | 140.5.0-1.el8_10.alma.1 |
| AlmaLinux:8 | thunderbird | 0 | 140.5.0-2.el8_10.alma.1 |
| AlmaLinux:9 | firefox | 0 | 140.5.0-1.el9_7.alma.1 |
| AlmaLinux:9 | firefox-x11 | 0 | 140.5.0-1.el9_7.alma.1 |
| Mageia:9 | firefox | 0 | 140.5.0-1.mga9 |
| Mageia:9 | firefox-l10n | 0 | 140.5.0-1.mga9 |
| Mageia:9 | thunderbird | 0 | 140.5.0-1.mga9 |
| Mageia:9 | thunderbird-l10n | 0 | 140.5.0-1.mga9 |
| SUSE:Enterprise Storage 7.1 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | MozillaThunderbird | 0 | 140.5.0-150200.8.245.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 0 | 140.5.0-150200.8.245.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | 0 | 140.5.0-112.289.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | 0 | 140.5.0-112.289.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | MozillaThunderbird | 0 | 140.5.0-150200.8.245.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 0 | 140.5.0-150200.8.245.1 |
| openSUSE:Leap 15.6 | MozillaFirefox | 0 | 140.5.0-150200.152.210.1 |
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.5.0-150200.8.245.1 |
| openSUSE:Leap 16.0 | MozillaFirefox | 0 | 140.5.0-160000.1.1 |
| openSUSE:Leap 16.0 | MozillaThunderbird | 0 | 140.5.0-bp160.1.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 145.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.5.0-1.1 |
Related vulnerabilities
- CVE-2025-14331 Same-origin policy bypass in the Request Handling component. Also affects firefox
- CVE-2025-14325 JIT miscompilation in the JavaScript Engine: JIT component. Also affects firefox
- CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component. Also affects firefox
- CVE-2025-14333 Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and… Also affects firefox
- CVE-2025-14328 Privilege escalation in the Netmonitor component. Also affects firefox
- CVE-2025-14329 Privilege escalation in the Netmonitor component. Also affects firefox
- CVE-2025-14323 Privilege escalation in the DOM: Notifications component. Also affects firefox
- CVE-2025-14321 Use-after-free in the WebRTC: Signaling component. Also affects firefox