CVE-2025-14327: 
NixOS vulnerability analysis and mitigation

CVE-2025-14327 is a spoofing vulnerability in the Downloads Panel component of Mozilla Firefox and Thunderbird, classified under CWE-290 (Authentication Bypass by Spoofing). By crafting a malformed data:// URI containing host information (e.g., data://google.com/application/x-msdownload;base64,...), an attacker can cause the Downloads Panel to display a trusted domain (such as google.com) as the download origin, deceiving users about the true source of a downloaded file. The vulnerability was reported by security researcher "Caro Kann" (Abhishek) and disclosed on December 9, 2025. Affected versions include Firefox before 146, Thunderbird before 146, Firefox ESR before 140.7, and Thunderbird ESR before 140.7. It carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory, Feedly).

The root cause is a regression introduced in Firefox 127 via bug 1873944, which changed how data: URIs with authority components are parsed. After this change, new URL("data://google.com/").host returns google.com — matching Chromium's behavior — but the Downloads Panel code assumed that if an nsIURI object has host information, it is authoritative and accurate. As a result, DownloadUtils.getURIHost (later consolidated into BrowserUtils.formatURIForDisplay) would extract and display the spoofed host from the malformed URI as the download origin. The fix involved ensuring that data URIs with opaque or malformed host components are not treated as having a valid origin, replacing the spoofed domain display with a generic (data) label. The vulnerability is classified as CWE-290 and was rated sec-moderate by Mozilla, though the reporter and Chromium's handling of a similar issue (issues.chromium.org/issues/40055527) suggested higher severity (Mozilla Bugzilla, Mozilla Advisory).

Successful exploitation allows a malicious website to trigger a file download (e.g., an .exe or .apk) while displaying a trusted domain name (such as google.com) as the download origin in Firefox's Downloads Panel, misleading users into believing the file originated from a legitimate source. This is a pure integrity impact — there is no confidentiality or availability impact — but the social engineering potential is significant, as users may be more likely to open or execute files they believe came from trusted sites. The vulnerability does not enable code execution on its own but can serve as a component in a broader phishing or malware delivery campaign (Mozilla Bugzilla, Mozilla Advisory).

No public exploit kit integration or in-the-wild exploitation has been reported for CVE-2025-14327. A proof-of-concept was included in the original bug report (hosted at a GitHub Pages URL) and demonstrated that the attack requires only a user visiting a malicious webpage and clicking a button to trigger a download — no authentication or special privileges are required. The EPSS score is very low at approximately 0.018%, reflecting limited automated exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A similar issue was independently reported and fixed in Chromium (Mozilla Bugzilla, Feedly).

1. Set up a malicious webpage: Host a webpage that, upon user interaction (e.g., a button click), programmatically triggers a file download using a crafted data:// URI with a spoofed host component.
2. Craft the malicious URI: Construct a URI in the form data://google.com/application/x-msdownload;base64,<base64-payload> — the google.com authority component causes Firefox's URL parser to extract it as the host.
3. Trigger the download: Use JavaScript to create an anchor element with the malicious href and a download attribute, then programmatically click it:

   function triggerDownload(uri, filename) {
     const link = document.createElement('a');
     link.href = uri;
     link.download = filename;
     document.body.appendChild(link);
     link.click();
     document.body.removeChild(link);
   }
   triggerDownload('data://google.com/application/x-msdownload;base64,ZXN0dGVzdA==', 'installer.exe');

4. Observe spoofed origin: The victim's Firefox Downloads Panel (Ctrl+J) displays google.com as the download origin instead of the actual page origin, deceiving the user into trusting the file.
5. Social engineering: Combine with fullscreen API abuse or other UI manipulation to maximize deception and increase the likelihood the victim executes the downloaded file (Mozilla Bugzilla).

• Network: Outbound HTTP/HTTPS requests to pages hosting JavaScript that programmatically creates anchor elements with data:// scheme URIs containing authority components (e.g., data://[domain]/).
• Logs: Browser download history entries showing a download origin of a well-known domain (e.g., google.com, microsoft.com) for a file that was not actually served from that domain's servers; cross-reference download origin against actual referring page URL.
• File System: Unexpected executable files (.exe, .apk, .msi) in the user's Downloads directory with no corresponding network request to the displayed origin domain in proxy or DNS logs.
• Process: Execution of recently downloaded files from the Downloads directory shortly after a browser session visiting an unfamiliar or suspicious webpage (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird ESR 140.7. Users should update to these versions or later immediately. No configuration-based workaround is available, as the vulnerability is triggered by standard browser functionality (file downloads via JavaScript). Red Hat Enterprise Linux users should apply the relevant RHSA errata (e.g., RHSA-2026:0667 for RHEL 8, RHSA-2026:0694 for RHEL 9) as distributed through their package management systems (Mozilla Advisory, Red Hat Bugzilla).

Mozilla rated the vulnerability as "moderate" impact, a classification the reporter (Caro Kann / Abhishek) disputed, arguing it should be rated higher given the full control over the spoofed origin and downloaded content. Mozilla's security team acknowledged it was "on the higher end of sec-moderate" and ultimately awarded a bug bounty. The reporter noted that a similar issue in Chromium (issues.chromium.org/issues/40055527) was initially rated moderate but upgraded to high during the bounty process. The CIS issued an advisory noting multiple vulnerabilities in Mozilla products could allow for arbitrary code execution in the same release cycle. No significant broader media coverage or social media discussion specific to this CVE was identified (Mozilla Bugzilla, Mozilla Advisory).