CVE-2025-14860
published 2025-12-18CVE-2025-14860: Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.32%
24.2th percentile
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 146.0.1-1 (sid) | firefox 146.0.1-1 (sid) |
| mozilla | firefox | < 146.0.1 | 146.0.1 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-14860: firefox - Use-after-free in the Disability Access APIs component. This vulnerability affec...
vendor_debian·2025·CVSS 9.8
CVE-2025-14860 [CRITICAL] CVE-2025-14860: firefox - Use-after-free in the Disability Access APIs component. This vulnerability affec...
Use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 146.0.1.
Scope: local
sid: resolved (fixed in 146.0.1-1)
Mozilla
Mozilla Foundation Security Advisory 2025-98: CVE-2025-14860
vendor_mozilla·CVSS 9.8
CVE-2025-14860 [CRITICAL] Mozilla Foundation Security Advisory 2025-98: CVE-2025-14860
Mozilla Foundation Security Advisory 2025-98
CVE: CVE-2025-14860
Product: Firefox
Impact: high
Fixed in: Firefox 146.0.1
VulDB
Mozilla Firefox up to 146.0.0 Access API use after free (Nessus ID 279423 / WID-SEC-2025-2885)
vuldb·2026-10-07·CVSS 9.8
CVE-2025-14860 [CRITICAL] Mozilla Firefox up to 146.0.0 Access API use after free (Nessus ID 279423 / WID-SEC-2025-2885)
A vulnerability described as critical has been identified in Mozilla Firefox up to 146.0.0. This impacts an unknown function of the component Access API. Such manipulation leads to use after free.
This vulnerability is uniquely identified as CVE-2025-14860. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
GHSA-7p9f-x9pw-w3x4: Use-after-free in the Disability Access APIs component
ghsa_unreviewed·2025-12-18
CVE-2025-14860 [CRITICAL] CWE-416 GHSA-7p9f-x9pw-w3x4: Use-after-free in the Disability Access APIs component
Use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 146.0.1.
OSV
CVE-2025-14860: Use-after-free in the Disability Access APIs component
osv·2025-12-18·CVSS 9.8
CVE-2025-14860 [CRITICAL] CVE-2025-14860: Use-after-free in the Disability Access APIs component
Use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 146.0.1.
No detection rules found.
No public exploits indexed.
2025-12-18
Published