Loading vulnerability…
JavaScript JIT Miscompilation in Mozilla Firefox and Thunderbird
CVE-2025-14330 is a miscompilation vulnerability in the JavaScript engine's just-in-time (JIT) compiler used by Mozilla Firefox and Thunderbird. The flaw causes incorrect compilation of JavaScript and is rated moderate impact by Mozilla. It was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. The specific compiler operation and triggering conditions are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Mozilla rates this vulnerability as moderate impact. The precise security consequences of this individual JIT miscompilation flaw are not specified; arbitrary code execution, sandbox escape, privilege escalation, and information disclosure are described for broader groups of vulnerabilities and cannot be attributed specifically to CVE-2025-14330.
If you can’t patch tonight, do this now.
Until patched, restrict exposure to untrusted web content and consider disabling JavaScript where feasible. These are precautionary exposure-reduction measures, not a confirmed workaround for this specific flaw.
Patch, then assume compromise.
Upgrade to Firefox 146, Firefox ESR 140.6, Thunderbird 146, or Thunderbird ESR 140.6, as appropriate, or a later supported release. For distribution-managed installations, apply the vendor's security update containing the corresponding fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.