CVE-2025-14330: Critical JIT Miscompilation in Firefox

CVE-2025-14330 is a critical JIT miscompilation bug (CVSS 9.8 in the NVD record) in the JavaScript engine of Firefox and Thunderbird. It is fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6. Mozilla rates it moderate. Update to a fixed build.

The advisories that cover this CVE are Mozilla's MFSA 2025-92 and its companion advisories for the ESR and Thunderbird releases. The Gold entry is at the Gold page for CVE-2025-14330.

What's affected

• Products: Mozilla Firefox and Mozilla Thunderbird.
• Component: JavaScript Engine: JIT.
• Fixed in: Firefox 146, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6.
• Weakness: CWE-119 (memory buffer errors), CWE-686 (incorrect argument type) and CWE-843 (type confusion).
• Severity in the NVD record: Critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Mozilla's own impact rating: Moderate (Mozilla advisory).
• CISA KEV: not listed.

How to check if you're exposed

In Firefox, open the menu, choose Help, then About Firefox. The dialog shows the version and starts an update check. In Thunderbird, use Help, then About Thunderbird. You can also run the program from a terminal with the version flag, for example firefox --version.

Compare what you see with the fixed builds above. A version lower than the fixed number on the same release line is affected. Remember that ESR is a separate line: ESR 140.5 is behind ESR 140.6, while Firefox 145 is behind Firefox 146.

For fleets, query your software inventory for Firefox and Thunderbird versions on endpoints, kiosks and shared images. Distribution packages, snap and flatpak builds, and portable copies can lag behind the vendor release, so check each source.

What to do now

1. Update Firefox and Thunderbird to a fixed build: version 146 or later, or ESR 140.6 or later.
2. If you run the older ESR 115 line, update to ESR 115.31 where it applies, and plan a move to a supported ESR line.
3. Check managed images, VDI templates and portable installs, which often miss automatic updates.
4. If your organization defers browser updates, shorten that delay for these releases.
5. Restart the browser after updating, since the fix does not apply to running processes.
6. Record the patched versions in your asset list so you can answer the question next time.

Why it matters

This is the second JIT miscompilation fixed in the same release, filed under three weakness classes including type confusion. Type confusion means the engine treats a value as one type when it is another, which can lead to reads or writes that the program did not intend.

As with the GMP issue, NVD gives 9.8 while Mozilla's advisory rates the bug moderate. The difference is a reminder that scores come from different views. The fix is the same as for the other bugs in the release, so applying the update covers them together. The record does not state exploitation and it is not in CISA KEV.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Mozilla Foundation Security Advisory 2025-92 (Firefox 146)
• Mozilla Foundation Security Advisory 2025-94 (Firefox ESR 140.6)
• Mozilla Foundation Security Advisory 2025-93 (Firefox ESR 115.31)
• Gold entry for CVE-2025-14330

Last reviewed: 19 October 2026.