This vulnerability involves privilege escalation within the Netmonitor component of Mozilla Firefox and Thunderbird. It was reported by satrya wira yudha and is tracked as CVE-2025-14329. The issue was fixed in Firefox 146 and Firefox ESR 140.6, as well as Thunderbird 146 and Thunderbird 140.6. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the vulnerability can be exploited remotely over the network with low attack complexity and no privileges required, but user interaction is needed. Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected software.

The vulnerability allows an attacker to escalate privileges via the Netmonitor component, potentially leading to full compromise of the affected Firefox or Thunderbird application. The high CVSS score (8.8) reflects the critical nature of the impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Users and administrators should update to these versions or later to remediate the vulnerability. Since the vendor advisory confirms the availability of patches, applying these updates is the recommended and effective mitigation.