Loading vulnerability…
JavaScript JIT Miscompilation in Mozilla Firefox and Thunderbird
CVE-2025-14324 is a high-severity miscompilation vulnerability in the JavaScript engine's just-in-time (JIT) compilation component used by Mozilla Firefox and Thunderbird. The flaw causes affected JIT compilation to produce incorrect execution behavior. It was fixed in Firefox 146, Firefox ESR 115.31 and 140.6, and Thunderbird 146 and 140.6. The specific faulty optimization, vulnerable function, and triggering JavaScript constructs are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability compromises the correctness of JIT-compiled JavaScript execution and is rated high impact. Its specific security consequences are not established by the available vulnerability-specific information; arbitrary code execution, sandbox escape, privilege escalation, and information disclosure cannot be individually confirmed for this CVE.
If you can’t patch tonight, do this now.
Until patched, restrict exposure to untrusted JavaScript-bearing content and consider disabling JavaScript where operationally feasible. These are exposure-reduction measures, not a confirmed CVE-specific workaround.
Patch, then assume compromise.
Upgrade to Firefox 146 or later, Firefox ESR 115.31 or later in the 115 ESR branch, Firefox ESR 140.6 or later in the 140 ESR branch, or Thunderbird 146 or 140.6 or later in the corresponding release branch. For distribution-managed installations, apply the vendor's security package containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.