Critical Vulnerabilities in Mozilla Firefox and Firefox ESR Allowing Arbitrary Code Execution

Multiple critical vulnerabilities were identified in Mozilla Firefox and Firefox ESR, with the most severe enabling arbitrary code execution. Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. The vulnerabilities include use-after-free in WebRTC (CVE-2025-14321), sandbox escape in Graphics (CVE-2025-14322), privilege escalation in the DOM (CVE-2025-14323), JIT miscompilation in the JavaScript Engine (CVE-2025-14324, CVE-2025-14325), and multiple memory safety bugs. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with full user rights, depending on the privileges of the compromised user. There are currently no reports of these vulnerabilities being exploited in the wild.

Security advisories from both the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC) urge users and administrators to apply the latest updates immediately to mitigate risk. The advisories highlight the importance of prompt patching, especially for large organizations and government entities, as the risk is assessed as high for these sectors. The updates address all known vulnerabilities, and users with fewer system privileges are less impacted than those with administrative rights.