Critical

JIT miscompilation in Firefox and Thunderbird JavaScript Engine

IdentifiersCVE-2025-14324CWE-682

CVE-2025-14324 is a JIT miscompilation vulnerability in the JavaScript Engine of Mozilla Firefox and Thunderbird. The issue affects Firefox versions prior to 146, Firefox ESR prior to 115.31 and 140.6, and Thunderbird prior to 146 and 140.6. The provided content identifies the vulnerable area as the JavaScript JIT component but does not include the specific function, optimization pass, or code path responsible for the miscompilation. In practice, JIT miscompilation flaws can cause the engine to generate incorrect machine code for attacker-controlled JavaScript, which may result in memory corruption or other unintended behavior during script execution.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could lead to arbitrary code execution in the context of the affected application. The broader Mozilla advisories associated with this release indicate that exploitation of the affected vulnerability set may also contribute to compromise of user data and system integrity, especially when combined with other browser flaws or when the user has elevated privileges. Based on the provided content, this issue is considered high risk because it is reachable through malicious web content or other attacker-supplied script content processed by the JavaScript engine.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure to untrusted active content. Avoid visiting untrusted websites, restrict access to suspicious web content and untrusted emails, and consider disabling or limiting JavaScript execution where operationally feasible. Additional defensive measures noted in the supporting advisories include least-privilege operation, anti-exploitation protections, application allowlisting, DNS/URL filtering, and user awareness measures. These are compensating controls only and do not remove the underlying flaw.

Remediation

Patch, then assume compromise.

Upgrade affected products to fixed versions released by Mozilla or downstream vendors. Specifically, update Firefox to 146 or later, Firefox ESR to 115.31 or 140.6 or later as applicable, and Thunderbird to 146 or 140.6 or later. Where vendor-packaged builds are used, apply the corresponding distribution security updates, such as the Debian and Rocky Linux package versions referenced in the advisories.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MozillaFirefoxapplication

MozillaThunderbirdapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

cisecurity blog msisca and eiisacNews

Dec 9, 2025

Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution

A just-in-time (JIT) miscompilation vulnerability in the JavaScript Engine of Mozilla products, potentially leading to arbitrary code execution.

unclassifiedNews

Dec 9, 2025

Security Vulnerabilities fixed in Firefox ESR 140.6

A JIT miscompilation vulnerability in the JavaScript Engine: JIT component of Firefox ESR, which could potentially lead to code execution or other unexpected behavior.

unclassifiedNews

Dec 9, 2025

Security Vulnerabilities fixed in Firefox 146

A JIT miscompilation vulnerability in the JavaScript Engine: JIT component of Firefox, which could potentially lead to code execution or other unexpected behavior.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8