CVE-2025-14860: 
NixOS vulnerability analysis and mitigation

CVE-2025-14860 is a use-after-free (UAF) vulnerability in the Disability Access APIs component of Mozilla Firefox, classified as high severity. It affects all Firefox versions prior to 146.0.1 and was discovered by external researcher Irvan Kurniawan ([:sourc7]). Mozilla disclosed and patched the vulnerability on December 18, 2025, via security advisory MFSA2025-98. The CVSS v3.1 base score is 9.8 (Critical) (Mozilla Advisory, Mozilla Bugzilla).

The vulnerability is classified as CWE-416 (Use After Free) and originates in the mozilla::a11y::NotificationController::WillRefresh function within Firefox's accessibility subsystem. The root cause is a race condition in the PresShell destruction sequence: when a DocAccessible is destroyed following PresShell teardown, FocusManager::ActiveItemChanged(null) is called, which attempts to fire a focus event and inadvertently creates a new DocAccessible referencing the already-dying PresShell — bypassing the shutdown guard and creating a dangling pointer condition. The bug was introduced by a regression in Bug 1997773 (nsFrameLoader::Destroy changes) and can be triggered when accessibility is enabled and a user interacts (clicks or uses Tab key) with a media element that repeatedly loads an invalid src via requestIdleCallback. The fix moves the accessible document shutdown to a later stage in PresShell::Destroy to prevent the UAF condition (Mozilla Bugzilla).

Successful exploitation could allow an attacker to execute arbitrary code in the context of the Firefox browser process, potentially leading to full browser compromise. The vulnerability carries high impacts on confidentiality, integrity, and availability, as arbitrary code execution could enable data theft, installation of malware, or further lateral movement within the victim's environment. Firefox ESR 115 and ESR 140 are confirmed unaffected; only Firefox 146 (non-ESR) required patching (Mozilla Advisory, Mozilla Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires accessibility features to be active in the browser (Accessibility Activated set to true in about:support) and a user interaction (mouse click or keyboard Tab) to trigger the crash, which somewhat limits opportunistic exploitation. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla awarded a security bug bounty to the reporter (Mozilla Bugzilla).

1. Reconnaissance: Identify targets running Firefox versions prior to 146.0.1 with accessibility features enabled (Accessibility Activated: true in about:support), which may include users of screen readers or other assistive technologies.
2. Craft malicious page: Create an HTML page that repeatedly loads an invalid media src attribute on a media element using requestIdleCallback, designed to trigger the accessibility notification controller's refresh cycle.
3. Deliver to victim: Host the malicious page and lure the target user to visit it (e.g., via phishing, malvertising, or a compromised website).
4. Trigger interaction: Wait for or socially engineer the user to click on the media element or use the Tab key to focus it, which triggers FocusManager::ActiveItemChanged(null) during PresShell destruction.
5. Achieve UAF: The use-after-free condition in mozilla::a11y::NotificationController::WillRefresh is triggered, potentially allowing heap memory manipulation and arbitrary code execution in the browser process (Mozilla Bugzilla).

• Process: Firefox tab crashes or unexpected process termination, particularly when interacting with media elements on web pages while accessibility features are enabled.
• Logs: AddressSanitizer reports referencing heap-use-after-free in mozilla::a11y::NotificationController::WillRefresh; crash minidump files with SEGV_MAPERR or SI_KERNEL signals generated by the Firefox process.
• File System: Unexpected crash report files (.dmp minidump files) in the Firefox crash reporter directory (e.g., %APPDATA%\Mozilla\Firefox\Crash Reports\ on Windows or ~/.mozilla/firefox/Crash Reports/ on Linux).
• Network: Outbound connections to unfamiliar hosts initiated by the Firefox process following interaction with a suspicious web page, which could indicate post-exploitation activity (Mozilla Bugzilla).

Mozilla has released Firefox 146.0.1, which contains the fix for this vulnerability by moving the accessible document shutdown to a later stage in PresShell::Destroy. Users should update Firefox to version 146.0.1 or later immediately. As a temporary workaround prior to patching, disabling accessibility features in Firefox (about:support → Accessibility) can reduce the attack surface, though this may impact users relying on assistive technologies. Firefox ESR 115 and ESR 140 are not affected and do not require updates for this specific CVE (Mozilla Advisory, Mozilla Bugzilla).

Mozilla rated the vulnerability as "high" impact and awarded a security bug bounty to the reporter, Irvan Kurniawan ([:sourc7]), recognizing the quality of the external report. The fix was expedited as an uplift to the 146.0.1 dot release, indicating Mozilla's assessment of the urgency. No significant broader media coverage or notable independent researcher commentary beyond the Mozilla bug tracker was identified (Mozilla Advisory, Mozilla Bugzilla).