CVE-2025-14331 is a same-origin policy bypass vulnerability in the Request Handling component of Mozilla Firefox and Thunderbird. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to sensitive information across origins. Mozilla fixed this vulnerability in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction required, impacting confidentiality and integrity but not availability.

Successful exploitation of this vulnerability could allow an attacker to bypass the same-origin policy, potentially leading to unauthorized access to information or manipulation of data across different web origins. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

An official fix is available and has been released by Mozilla. Users and administrators should update to Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, or Thunderbird 140.6 to remediate this vulnerability. No additional mitigation steps are required beyond applying these updates.