CVE-2025-14327 is a spoofing vulnerability affecting the Downloads Panel component in Mozilla Firefox and Thunderbird. The vulnerability could allow an attacker to present misleading information to users via the Downloads Panel. Mozilla fixed this issue in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7 as part of a broader security update addressing multiple vulnerabilities. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but high impact on integrity. The vendor advisory confirms the fix and classifies the impact as moderate.

The vulnerability allows spoofing in the Downloads Panel, potentially misleading users by displaying falsified download information. This can impact the integrity of the user interface and user trust but does not affect confidentiality or availability. The CVSS score of 7.5 reflects a high severity rating, though Mozilla classifies the impact as moderate. There are no reports of exploitation in the wild. The vulnerability was fixed in Firefox 146 and Thunderbird 146 releases.

Mozilla has released official fixes for this vulnerability in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7. Users and administrators should update to these versions or later to mitigate this vulnerability. Since the fix is officially available, no additional mitigation steps are required beyond applying the update.