CVE-2025-14322 is a sandbox escape vulnerability in Mozilla Firefox's Graphics: CanvasWebGL component due to incorrect boundary conditions. This vulnerability allows an attacker to potentially bypass sandbox restrictions, leading to high confidentiality and integrity impacts. It was reported by Oskar L and fixed in Firefox 146 and Firefox ESR 115.31 among other versions. The CVSS v3.1 base score is 8.0, reflecting network attack vector with high complexity, no privileges required, user interaction required, and scope changed. The vendor advisory confirms the fix and provides references to the underlying bug (Bug 1996473).

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with elevated privileges. The CVSS score of 8.0 indicates a high impact on confidentiality and integrity, with no impact on availability. There are currently no known exploits in the wild. The vulnerability affects Firefox and Thunderbird products prior to the fixed versions.

Mozilla has released official fixes for this vulnerability in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Users and administrators should update affected products to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.