CVE-2025-13018 Mitigation bypass in the DOM: Security component

High 8.1 Published 11 Nov 2025 Updated 13 Apr 2026

Attackers can bypass DOM security mitigations in Firefox and Thunderbird, potentially enabling further exploitation of the browser environment.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-13018?

CVE-2025-13018 is a high-severity vulnerability in Mozilla Firefox, published on 11 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Weakness: CWE-288

Which versions are affected by CVE-2025-13018?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2025-13018?

Upgrade to a fixed version.

Is CVE-2025-13018 being exploited?

There is no known exploitation of CVE-2025-13018 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2025-13018, GHSA-v7r3-hxvj-7w2p, UBUNTU-CVE-2025-13018.