CVE-2025-14328 is a privilege escalation vulnerability affecting the Netmonitor component in Mozilla Firefox and Thunderbird. It allows an attacker to gain elevated privileges within the affected application. The issue was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. The vulnerability is part of a set of security fixes released on December 9, 2025, addressing multiple high and moderate impact vulnerabilities. The CVSS 3.1 base score is 8.8, reflecting high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox or Thunderbird application, potentially leading to unauthorized actions or access within the context of the affected software. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. However, the vendor advisory classifies the impact of this specific vulnerability as moderate. There are no known exploits in the wild reported at the time of disclosure.

This vulnerability has been fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update affected products to these versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.