Loading vulnerability…
CVE-2025-14325 is a JIT miscompilation vulnerability in the JavaScript Engine JIT component affecting Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird before 140.6. The issue arises from incorrect JIT compilation behavior, where JavaScript code may be miscompiled and executed with unintended semantics. The provided advisories do not identify a specific vulnerable function, but classify the flaw as a JavaScript engine JIT miscompilation. In Mozilla products, this class of bug can undermine engine safety assumptions and may be leveraged through crafted web content or active content rendered by the application.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a single-file GitHub Actions workflow that automates reproduction of a claimed CVE-2025-14325 proof of concept against a pre-patch Mozilla Firefox/SpiderMonkey build. The workflow is not a general exploit framework module; it is a self-contained CI pipeline that installs build dependencies, clones the official Firefox mirror, checks out a specified pre-fix commit, bootstraps the Mozilla build environment, creates a mozconfig for the JavaScript shell, builds the js shell, writes a JavaScript PoC, executes it, and uploads logs/artifacts. The exploit capability is limited to local proof-of-concept triggering. The embedded JavaScript attempts to exercise a vulnerability involving SharedArrayBuffer growth during an indexed write with a crafted valueOf side effect, likely aiming at JIT/IC confusion or bounds/state inconsistency in SpiderMonkey. It performs repeated warm-up calls, a final trigger call, and garbage collection grooming. However, the so-called shellcode stage is only a placeholder function that prints success text and returns a string; there is no real memory read/write primitive, native code execution, reverse shell, downloader, or persistence logic. Repository structure is minimal: only .github/workflows/blank.yml exists. That file contains shell commands and an inline JavaScript exploit body. There are no auxiliary source files, no standalone exploit script checked into the repo, and no external C2 or callback infrastructure. The only network-relevant endpoint is the GitHub URL used to clone Mozilla Firefox source. Overall, this is best classified as a PoC reproduction workflow for a local engine bug rather than an operational or weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A just-in-time (JIT) miscompilation vulnerability in the JavaScript Engine of Mozilla products, potentially leading to arbitrary code execution.
A JIT miscompilation vulnerability in the JavaScript Engine: JIT component of Firefox ESR, which could potentially lead to code execution or other unexpected behavior.
A JIT miscompilation vulnerability in the JavaScript Engine: JIT component of Firefox, which could potentially lead to code execution or other unexpected behavior.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.