CVE-2025-14321: Mozilla Firefox Use-After-Free Vulnerability

CVE-2025-14321 Overview

CVE-2025-14321 is a use-after-free vulnerability [CWE-416] in the WebRTC Signaling component of Mozilla Firefox and Mozilla Thunderbird. The flaw affects memory management within the real-time communications stack used for browser-based audio, video, and data channels. Mozilla addressed the issue in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. An attacker can trigger the condition by serving crafted WebRTC signaling content to a victim's browser, potentially leading to arbitrary code execution within the renderer process.

Critical Impact
Remote attackers can exploit this use-after-free over the network without authentication or user interaction, resulting in memory corruption that may lead to arbitrary code execution.

Affected Products

Mozilla Firefox versions prior to 146
Mozilla Firefox ESR versions prior to 140.6
Mozilla Thunderbird versions prior to 146 and 140.6

Discovery Timeline

2025-12-09 - CVE-2025-14321 published to the National Vulnerability Database
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-14321

Vulnerability Analysis

The vulnerability resides in the WebRTC Signaling component, which negotiates session parameters between peers using protocols such as Session Description Protocol (SDP) and Interactive Connectivity Establishment (ICE). A use-after-free condition occurs when the signaling code retains and dereferences a pointer to memory that has already been released. The attack surface is reachable through standard web content because Firefox exposes WebRTC APIs to JavaScript without requiring elevated privileges or user interaction beyond visiting a page.

Memory corruption in this code path can be steered by an attacker to achieve control over freed object contents. Successful exploitation typically results in arbitrary code execution constrained by Firefox's sandbox, though chained sandbox escapes could broaden the impact. The same code is shared by Thunderbird, which inherits the exposure through its embedded Gecko engine.

Root Cause

The defect is classified as CWE-416 (Use After Free). Mozilla's advisories indicate the signaling component failed to maintain correct object lifetime guarantees, allowing reuse of a stale reference after the underlying allocation was freed. Mozilla published technical detail in Bugzilla #1992760.

Attack Vector

An attacker hosts a malicious page or sends crafted content that initiates WebRTC signaling against the victim browser. By manipulating signaling state transitions, the attacker forces the vulnerable object to be freed while a reference remains in use. No authentication is required and exploitation occurs over the network.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-14321

Indicators of Compromise

Firefox or Thunderbird processes crashing with signatures referencing WebRTC, PeerConnection, or signaling modules
Unexpected child process spawns from firefox.exe or thunderbird.exe following web browsing activity
Outbound WebRTC traffic (STUN, TURN, DTLS) to unfamiliar endpoints from non-conferencing user sessions

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the environment and flag any builds below the patched releases
Monitor endpoint telemetry for renderer process crashes correlated with browsing sessions, which can indicate exploitation attempts
Inspect proxy and DNS logs for connections to suspicious signaling or TURN servers initiated by browser processes

Monitoring Recommendations

Enable crash reporting and aggregate Firefox and Thunderbird crash signatures for centralized analysis
Alert on browser child processes executing shell utilities, scripting engines, or LOLBins immediately after page loads
Track WebRTC API usage patterns in environments where peer-to-peer communications are not required

How to Mitigate CVE-2025-14321

Immediate Actions Required

Update Firefox to version 146 or later and Firefox ESR to 140.6 or later on all managed endpoints
Update Thunderbird to version 146 or later, or to ESR 140.6 or later
Validate patch deployment through software inventory and remediate non-compliant hosts

Patch Information

Mozilla addressed CVE-2025-14321 in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Refer to the vendor advisories for release details: MFSA-2025-92, MFSA-2025-94, MFSA-2025-95, and MFSA-2025-96.

Workarounds

Disable WebRTC in environments where it is not required by setting media.peerconnection.enabled to false in about:config
Restrict outbound STUN, TURN, and DTLS traffic at the network perimeter for user populations that do not need browser-based real-time communication
Enforce strict content filtering and isolate browsing of untrusted sites through remote browser isolation where feasible until patches are deployed

bash

# Configuration example: disable WebRTC via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "media.peerconnection.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}