CVE-2025-14322CWE-754

CVE-2025-14322

High · published December 9, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

⚡ A sneaky little sandbox escape is lurking in the Graphics: CanvasWebGL component! Just like a magician slipping out of their handcuffs, this vulnerability can bypass your defenses and access restricted areas! Think of it as a delivery driver getting access to the locked warehouse where all the valuable packages are stashed. If they find a weak point in the boundary, they can sneak right in and take whatever they want! If exploited, this vulnerability could allow an attacker to escape the confines of the sandbox environment, potentially leading to unauthorized access to sensitive data or system resources. That's like giving a ticket to your most valuable assets and letting them roam free!

Put simply

Think of it as a delivery driver getting access to the locked warehouse where all the valuable packages are stashed. If they find a weak point in the boundary, they can sneak right in and take whatever they want! This flaw arises from incorrect boundary conditions in the Graphics: CanvasWebGL component, allowing a malicious actor to bypass the isolation that sandboxes are supposed to enforce. Essentially, it’s like a poorly built fence that lets anyone stroll right into a secure area.

What to do

If exploited, this vulnerability could allow an attacker to escape the confines of the sandbox environment, potentially leading to unauthorized access to sensitive data or system resources. That's like giving a ticket to your most valuable assets and letting them roam free! Make sure to update to Firefox 146 or later, Firefox ESR 115.31 or later, Thunderbird 146 or 140.6 immediately. Regularly check for updates and review your security settings to ensure that all components are properly configured. 🛡️ You've got this! With these steps, you'll be one step closer to securing your digital space! 🚀

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2025-12-09T21:17Z
Affected products (5)
ProductVersionsFixed in
mozilla/firefox< 115.31.0115.31.0
mozilla/firefox< 146.0146.0
mozilla/firefox≥ 116.0, < 140.6.0140.6.0
mozilla/thunderbird< 140.6.0140.6.0
mozilla/thunderbird< 146.0146.0
References (6)
EPSS history
Timeline
  • 09 DEC 13:37Z
    Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
    cvelistv5