CVE-2025-14323 is a privilege escalation vulnerability affecting the DOM Notifications component in Mozilla Firefox and Thunderbird. The flaw could allow an attacker to gain elevated privileges, potentially impacting the security context of the browser. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. The CVSS v3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating that the vulnerability can be exploited remotely with low attack complexity, requires user interaction, and results in high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the browser, potentially leading to full compromise of the affected application’s security context. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of user data and browser operations. No active exploits have been reported in the wild as of the advisory date.

This vulnerability has been fixed by Mozilla in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these official updates. No additional mitigation steps are indicated by the vendor advisory.