CVE-2025-14327
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Dec 9, 2025
CISA due date
—
The record
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | firefox | 0 | 140.7.0-1.el9_7.alma.1 |
| AlmaLinux:9 | firefox-x11 | 0 | 140.7.0-1.el9_7.alma.1 |
| AlmaLinux:9 | thunderbird | 0 | 140.7.0-1.el9_7.alma.1 |
| Mageia:9 | firefox | 0 | 140.7.0-1.mga9 |
| Mageia:9 | firefox-l10n | 0 | 140.7.0-1.mga9 |
| Mageia:9 | nss | 0 | 3.120.0-1.mga9 |
| Mageia:9 | thunderbird | 0 | 140.7.0-1.mga9 |
| Mageia:9 | thunderbird-l10n | 0 | 140.7.0-1.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| openSUSE:Leap 15.6 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| openSUSE:Leap 16.0 | MozillaFirefox | 0 | 140.7.0-160000.1.1 |
| openSUSE:Leap 16.0 | MozillaThunderbird | 0 | 140.8.1-bp160.1.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 146.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.7.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 140.7.0-1.1 |
Related vulnerabilities
- CVE-2026-0885 Use-after-free in the JavaScript: GC component. Also affects firefox
- CVE-2026-0890 Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. Also affects firefox
- CVE-2026-0886 Incorrect boundary conditions in the Graphics component. Also affects firefox
- CVE-2026-0887 Clickjacking issue, information disclosure in the PDF Viewer component. Also affects firefox
- CVE-2026-0891 Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and… Also affects firefox
- CVE-2026-0877 Mitigation bypass in the DOM: Security component. Also affects firefox
- CVE-2026-0883 Information disclosure in the Networking component. Also affects firefox
- CVE-2026-0878 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL… Also affects firefox