High · published December 9, 2025
⚡ A sneaky privilege escalation lurks in the Firefox and Thunderbird Notifications component! 🎉 Think of it like a hotel room where anyone can sneak into the VIP lounge without the correct keycard—this vulnerability lets a regular user access restricted features just by interacting with notifications. An attacker could exploit this flaw to escalate their privileges, gaining unauthorized access to sensitive features and information. This could lead to data exposure or manipulation, potentially wreaking havoc on both user privacy and application integrity!
Think of it like a hotel room where anyone can sneak into the VIP lounge without the correct keycard—this vulnerability lets a regular user access restricted features just by interacting with notifications. This vulnerability allows attackers to gain elevated privileges by exploiting improper handling of notifications in the Document Object Model (DOM), compromising the security model of the application.
An attacker could exploit this flaw to escalate their privileges, gaining unauthorized access to sensitive features and information. This could lead to data exposure or manipulation, potentially wreaking havoc on both user privacy and application integrity! Update to Firefox version 146, Firefox ESR 115.31, or Thunderbird version 146 to patch this vulnerability. Make sure to communicate with all users to ensure they update immediately! You've got this! By updating, you can keep your applications safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.31.0 | 115.31.0 |
| mozilla/firefox | < 146.0 | 146.0 |
| mozilla/firefox | ≥ 116.0, < 140.6.0 | 140.6.0 |
| mozilla/thunderbird | < 140.6.0 | 140.6.0 |
| mozilla/thunderbird | < 146.0 | 146.0 |