External risk intelligence

Firefox Disability Access API Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-14860

This vulnerability affects a client-side web browser application. Firefox is a desktop/mobile end-user client, not an internet-facing service, gateway, or appliance. Vulnerabilities in client-side software do not involve a public-facing network surface in the context of infrastructure deployment.

Use After Free

Mozilla Firefox

before 146.0.1

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability has been identified in the Disability Access APIs component of Firefox. This critical issue, if exploited, could allow an attacker to remotely compromise systems by accessing the network without any user interaction or privileges. The main concern is confirming relevance and exposure due to the nature of the affected component.

Software flaw allows remote system compromise.
Matters due to potential for widespread, unattended attacks.
Focus on confirming relevance and impact for your systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a use-after-free vulnerability in Firefox's Disability Access APIs by luring a user to a malicious website. This site would trigger a sequence of events causing the browser to attempt to use memory that has already been freed. This could lead to memory corruption, potentially allowing the attacker to execute arbitrary code within the context of the browser.

Requires user to visit malicious site.
Triggered by interacting with accessibility features.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This use-after-free vulnerability in the Disability Access APIs component of Firefox could allow an attacker to execute arbitrary code when a user visits a malicious website.

System data could be affected.
Exposure could happen via a malicious website.
Arbitrary code execution is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Disability Access APIs component of Firefox impacts client-side applications. Initial triage should focus on identifying all instances of the affected browser, determining their reachability and business criticality, and confirming the accountable owner before planning remediation.

Browser owners should manage this issue.
Verify browser reachability and criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Firefox Disability Access API?

This component is part of the browser's infrastructure designed to communicate with assistive technologies, such as screen readers, to ensure the web remains navigable for users with disabilities. It bridges the browser's internal rendering engine with external software that interprets UI elements for the user.

What does CVE-2025-14860 mean by use-after-free?

This is a memory management error classified as CWE-416. It occurs when the browser continues to reference a location in memory after it has been cleared or released. If an attacker can manipulate this reference, they may be able to force the browser to perform unintended actions or execute unauthorized code.

How is this vulnerability triggered?

The flaw is triggered when a user navigates to a specially crafted malicious website that interacts with the browser's accessibility features. It is important to note that the vulnerability does not trigger through background system processes or local file access; it requires the browser to actively process malicious web content.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to affect infrastructure security. Because Firefox is a client-side application rather than an internet-facing service, gateway, or server, it does not present the typical network attack surface associated with infrastructure-level threats.

What should I do to secure my environment?

Since this is a client-side issue, your primary goal is to ensure all instances of Firefox are updated to version 146.0.1 or later. Start by verifying where the browser is installed in your environment, identify the users or teams responsible for those systems, and prioritize applying the software update to mitigate the memory corruption risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.