Loading vulnerability…
JavaScript JIT Miscompilation in Mozilla Firefox and Thunderbird
CVE-2025-14325 is a high-impact miscompilation vulnerability in the JavaScript engine's just-in-time compiler used by Mozilla Firefox and Thunderbird. Incorrect compilation of JavaScript can cause execution behavior that differs from the intended program semantics. The specific optimization, vulnerable function, and exploitation mechanism are not disclosed. The vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Mozilla rates this vulnerability high impact. The precise security consequences of this individual JIT miscompilation are not specified. Broader updates containing its fix address potential arbitrary code execution and other security-boundary violations, but those outcomes are not individually established for CVE-2025-14325.
If you can’t patch tonight, do this now.
Until patched, restrict exposure to untrusted web and other active content. Disabling JavaScript where operationally feasible can reduce exposure to the affected engine, but no CVE-specific validated workaround is specified. These measures do not replace installing the update.
Patch, then assume compromise.
Upgrade to Firefox 146, Firefox ESR 140.6, Thunderbird 146, or Thunderbird 140.6, or a later supported release in the applicable release line. For distribution-managed installations, install the vendor's security-updated package containing the fix.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.