CVE-2025-14323: 
NixOS vulnerability analysis and mitigation

CVE-2025-14323 is a privilege escalation vulnerability in the DOM: Notifications component of Mozilla Firefox and Thunderbird, caused by missing security checks on the icon parameter of the Web Notifications API. Reported by researcher "tiebuchen" and disclosed on December 9, 2025, it affects Firefox before 146, Firefox ESR before 115.31, Firefox ESR 116.x–140.x before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. The vulnerability has a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory MFSA2025-92, Mozilla Advisory MFSA2025-94, Feedly).

The root cause is that Firefox's image loader (imgLoader) used the system principal — rather than the triggering content principal — when loading notification icon URIs, effectively bypassing all content security checks (CWE-269: Improper Privilege Management). This regression was introduced approximately 10 years prior via Bug 1206961. Because no adequate URL validation was applied to the icon parameter of new Notification(), an attacker could supply file://, http://localhost/, or arbitrary custom protocol URIs. This enabled: (1) local network access bypass (SSRF-like probing of localhost/private IPs), (2) local filesystem access via file:// URLs, and (3) triggering arbitrary external protocol handlers without proper origin context. The fix, committed by assignee Artur Iunusov, replaces the system principal with the triggering principal when loading notification icons (Mozilla Bugzilla).

Successful exploitation allows a malicious website (with notification permission granted by the user) to bypass multiple browser security boundaries, including Local Network Access restrictions, same-origin policy, Content Security Policy, and local filesystem isolation. An attacker can probe internal network services (localhost and private IP ranges), attempt to access local files via file:// URIs, and trigger external protocol handlers without displaying the originating site's context to the user. While the notification sender cannot directly read the loaded resource's content, the ability to make arbitrary requests to local network resources enables client-side SSRF reconnaissance and potential social engineering via unexpected protocol handler prompts (Mozilla Bugzilla, Mozilla Advisory MFSA2025-92).

Exploitation requires that the victim has previously granted notification permission to the attacker-controlled website, making user interaction a prerequisite. No public proof-of-concept exploit code or exploit kit integration has been identified, and there is no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (very low probability of exploitation in the near term) (Feedly). The bug was awarded a Mozilla security bounty, indicating it was considered a genuine security risk (Mozilla Bugzilla).

1. Obtain notification permission: Lure the victim to visit an attacker-controlled website (e.g., via phishing) and convince them to grant notification permission when prompted by the browser.
2. Craft malicious notification: Execute JavaScript in the browser context to create a notification with a malicious icon parameter:
   • For local network probing: new Notification('Test', { icon: 'http://192.168.1.1/admin' });
   • For local file access: new Notification('Test', { icon: 'file:///C:/Users/victim/secret.png' });
   • For external protocol triggering: new Notification('Test', { icon: 'calculator://test' });
3. Trigger the request: The browser's notification subsystem loads the icon URI using the system principal, bypassing content security checks and making the request to the specified resource.
4. Achieve objective: Depending on the payload — probe internal services for reconnaissance, attempt to load local files, or trigger external application handlers on the victim's system. Note: the attacker cannot directly read response content, but can infer service availability via timing or side channels (Mozilla Bugzilla).

• Network: Outbound HTTP requests from the browser process to localhost, 127.0.0.1, or RFC-1918 private IP ranges (e.g., 192.168.x.x, 10.x.x.x, 172.16–31.x.x) with paths or query strings containing notification_icon or similar identifiers; unexpected DNS lookups for internal hostnames originating from the browser.
• Logs: Browser network logs or proxy logs showing requests to local network resources or file:// URIs initiated by a web origin; OS-level logs showing external protocol handler invocations (e.g., calculator://, ms-calculator://) triggered by the browser process.
• Process: Unexpected child processes or external applications launched by the Firefox/Thunderbird process without explicit user action (e.g., calculator, mail client, or other protocol-registered applications).
• File System: No direct file artifacts are created by exploitation, but access attempts to sensitive local files (e.g., file:///C:/Windows/System32/drivers/etc/hosts) may appear in OS audit logs if file auditing is enabled.

Mozilla has released patched versions addressing this vulnerability: Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update to these versions immediately. No configuration-based workaround is available; however, revoking notification permissions for untrusted websites reduces the attack surface. Enterprise administrators can enforce notification permission policies via group policy or managed configurations to restrict which sites may request notification access (Mozilla Advisory MFSA2025-92, Mozilla Advisory MFSA2025-93, Mozilla Advisory MFSA2025-94).

Mozilla awarded a security bounty to the external reporter "tiebuchen" for responsibly disclosing this vulnerability. Mozilla engineer Daniel Veditz noted in the bug tracker that while the missing checks were clearly a bug, some of the hypothetical harms described by the reporter were overstated — for example, the notification sender cannot read the loaded resource's content, limiting the practical impact of the file:// bypass. Veditz also noted the patch was incomplete with respect to Local Network Access warnings and CSP enforcement, and filed a follow-up bug for remaining issues. The vulnerability received broad downstream attention, with Red Hat, Debian, Oracle Linux, Rocky Linux, AlmaLinux, SUSE, Slackware, and Amazon Linux all issuing security advisories and updated packages (Mozilla Bugzilla).