CVE-2025-14331: 
NixOS vulnerability analysis and mitigation

CVE-2025-14331 is a same-origin policy (SOP) bypass vulnerability in the WebExtensions Request Handling component of Mozilla Firefox and Thunderbird, specifically affecting the browser.identity.launchWebAuthFlow OAuth implementation. Discovered and reported by Igor Morgenstern of Aisle Research, it was publicly disclosed on December 9, 2025. Affected versions include Firefox before 146, Firefox ESR before 115.31, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. It carries a CVSS v3.1 base score of 6.5 (Medium) (Mozilla Advisory, Mozilla Advisory ESR 140.6).

The root cause is a logic error (CWE-346: Origin Validation Error) in toolkit/components/extensions/parent/ext-identity.js where an incorrect && (AND) operator is used instead of || (OR) in the redirect validation guard for OAuth flows. The flawed condition !wrapper.browserElement && wrapper.browserElement !== window.gBrowser.selectedBrowser means the early-exit guard is never triggered, allowing channels from any tab — not just the legitimate OAuth popup — to be treated as valid. An attacker-controlled tab can exploit this by issuing a fetch() request to the extension's predictable redirect URL (e.g., https://<ext-id>.extensions.allizom.org/?code=malicious), causing the OAuth popup to close prematurely and launchWebAuthFlow to resolve with the attacker's URL. The fix is a one-line change correcting the boolean operator (Mozilla Bugzilla).

Successful exploitation allows an attacker-controlled tab to intercept OAuth flows initiated by WebExtensions using the browser.identity.launchWebAuthFlow API, causing the extension to receive attacker-controlled OAuth codes or tokens. This can result in account binding (the user's extension session is tied to the attacker's account), data exfiltration (user data synced post-login is sent to the attacker's remote account), and session fixation (the user unknowingly operates under the attacker's account context within the extension). The impact is limited to users running affected WebExtensions that use the identity API, but for those users the consequences can be severe (Mozilla Bugzilla, Mozilla Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-14331. Mozilla rated the vulnerability as "sec-moderate" severity, noting that exploitation requires some timing and guessing to succeed and affects only users of specific WebExtensions that use the launchWebAuthFlow identity API. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Mozilla Bugzilla).

1. Identify a target extension: Identify a WebExtension installed in the victim's Firefox browser that uses browser.identity.launchWebAuthFlow for OAuth authentication (e.g., a social login or cloud storage extension).
2. Determine the redirect URL: Identify the extension's predictable OAuth redirect URL, which follows the pattern https://<extension-id>.extensions.allizom.org/ — the extension ID can often be found in the browser's extension management page or via public extension stores.
3. Trigger the OAuth flow: Socially engineer or wait for the victim to initiate an OAuth sign-in through the target extension, which opens an OAuth popup window.
4. Race the redirect: From an attacker-controlled tab (e.g., a malicious webpage the victim has open), issue a fetch() request to the extension's redirect URL with a crafted OAuth code: fetch('https://<ext-id>.extensions.allizom.org/?code=attacker_controlled_code').
5. Intercept the flow: Due to the logic error in the redirect validation, the OAuth popup closes immediately and launchWebAuthFlow resolves with the attacker's URL and code, binding the extension to the attacker's account.
6. Achieve objective: The extension now operates under the attacker's account context, enabling data exfiltration of any user data the extension subsequently syncs or transmits (Mozilla Bugzilla).

• Network: Unexpected fetch() requests from a browser tab to *.extensions.allizom.org redirect URLs not initiated by the user; OAuth token exchanges completing with codes not originating from the legitimate OAuth provider.
• Logs: Browser console logs showing launchWebAuthFlow resolving with unexpected redirect URLs or OAuth codes; extension background page logs indicating account binding to an unrecognized account.
• Behavioral: User reports of being unexpectedly logged into a different account within an extension; extension data appearing to sync to an unknown remote account after an OAuth flow.

Mozilla has released patched versions addressing this vulnerability: Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users should update to these versions immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize deploying the updated versions via their software management systems, particularly for environments where users rely on WebExtensions using OAuth authentication (Mozilla Advisory, Mozilla Advisory ESR 140.6, Mozilla Advisory ESR 115.31).

Mozilla classified the vulnerability as "sec-moderate" and awarded a security bounty to the reporter, Igor Morgenstern of Aisle Research. The assigned developer (Luca Greco) escalated the priority to P1/S2 internally, noting a preference to fix it quickly despite the timing requirements for exploitation. The CIS Security advisory noted the broader December 2025 Firefox release addressed multiple vulnerabilities that could allow arbitrary code execution (CIS Advisory). Downstream Linux distributions including Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, and AlmaLinux all issued security advisories and updated packages shortly after Mozilla's disclosure.