CVE-2025-14322: 
NixOS vulnerability analysis and mitigation

CVE-2025-14322 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird. Discovered by security researcher Oskar L and reported via Mozilla's bug bounty program, it was publicly disclosed on December 9, 2025. Affected versions include Firefox before 146, Firefox ESR before 115.31, Firefox ESR before 140.6 (for the 116.x–140.x branch), Thunderbird before 146, and Thunderbird ESR before 140.6. It carries a CVSS v3.1 base score of 8.0 (High) (Mozilla Advisory, Mozilla Advisory ESR 140.6).

The root cause is an out-of-bounds write (heap buffer overflow) in the TexUnpackBlob::ConvertIfNeeded function within dom/canvas/TexUnpackBlob.cpp, classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). When converting WebGL texture data, the destination buffer is allocated based on the dstStride value, but the subsequent ConvertImage call copies data using the source's minimal stride (bytesPerPixel * width). An attacker can craft a shared surface via the PCompositorManager IPC actor with a stride smaller than the minimum required stride, causing memcpy to write beyond the allocated heap buffer. The fix adds a validation check to ensure strides passed into ConvertIfNeeded are large enough for the specified format and width. A proof-of-concept patch and reproduction HTML page were included in the bug report (Mozilla Bugzilla).

Successful exploitation allows an attacker to escape the Firefox content process sandbox, enabling arbitrary memory writes of attacker-controlled size outside the allocated heap buffer. On Windows, the vulnerability is hosted under the GPU process and can be escalated to the browser process; on Linux, it directly affects the browser process. This cross-platform vulnerability could lead to full browser process compromise, enabling code execution at the privilege level of the browser, access to sensitive user data, and potential lateral movement to the underlying operating system (Mozilla Bugzilla, Mozilla Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires user interaction (a victim must visit a malicious page) and has high attack complexity, as it requires crafting a shared surface with a specific invalid stride via the IPC layer. The EPSS score is approximately 0.03% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Mozilla awarded a security bounty to the reporter, indicating the bug was found through responsible disclosure (Mozilla Bugzilla).

1. Reconnaissance: Identify targets running vulnerable Firefox or Thunderbird versions (Firefox < 146, Firefox ESR < 115.31 or < 140.6, Thunderbird < 146 or < 140.6) on any platform.
2. Set up malicious page: Host a crafted HTML page that uses the WebGL2 API (getContext('webgl2')) and calls gl.texImage2D() with an ImageBitmap derived from a specially crafted ImageData object.
3. Craft malicious shared surface: Using internal Firefox IPC mechanisms (PCompositorManager/PCanvasManager), create a SourceSurfaceSharedData with a stride value smaller than the minimum required stride for the given width and pixel format (e.g., width=0x1000, stride=0x100 instead of the required 0x4000 for RGBA).
4. Trigger out-of-bounds write: Supply the malicious surface as a SurfaceDescriptorExternalImage to the WebGL texture upload path with flipY=true to force the conversion code path in ConvertIfNeeded, causing memcpy to write beyond the allocated buffer.
5. Achieve sandbox escape: Exploit the heap overflow to corrupt adjacent memory structures, enabling escape from the content process sandbox and execution of arbitrary code in the GPU or browser process (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users should update to these versions or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize patching Firefox ESR deployments, as these are commonly used in managed environments (Mozilla Advisory, Mozilla Advisory ESR 115.31, Mozilla Advisory ESR 140.6).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2025-14322, could allow for arbitrary code execution. Red Hat, Oracle, Debian, SUSE, Rocky Linux, AlmaLinux, Amazon Linux, and Slackware all issued downstream security advisories and updated packages shortly after Mozilla's disclosure. The vulnerability received a security bounty from Mozilla, reflecting its significance. No notable independent researcher commentary or significant social media discussion beyond standard patch notification coverage has been identified.