CVE-2025-1933: Mozilla Firefox WASM JIT Vulnerability

CVE-2025-1933 Overview

CVE-2025-1933 affects Mozilla Firefox, Firefox ESR, and Thunderbird on 64-bit CPU architectures. The flaw resides in the Just-In-Time (JIT) compiler's handling of WebAssembly (WASM) i32 return values. When the JIT compiles these 32-bit integer returns, residual bits from leftover memory can remain in the upper portion of a 64-bit register. Downstream code can then interpret those values as a different type, leading to type confusion. Mozilla fixed the issue in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Critical Impact

Attackers can craft malicious WebAssembly modules that trigger type confusion in the Firefox JIT, enabling memory corruption and potential code execution within the browser content process.

Affected Products

• Mozilla Firefox versions prior to 136
• Mozilla Firefox ESR versions prior to 115.21 and 128.8
• Mozilla Thunderbird versions prior to 136 and 128.8

Discovery Timeline

• 2025-03-04 - CVE-2025-1933 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-1933

Vulnerability Analysis

The vulnerability stems from incorrect register handling during JIT compilation of WebAssembly code on 64-bit platforms. WebAssembly defines i32 as a 32-bit integer type. On 64-bit CPUs, these values live in 64-bit general-purpose registers. The JIT compiler is responsible for ensuring that the upper 32 bits of the register are zeroed or sign-extended before the value is consumed as a 32-bit result.

In the affected code path, the JIT failed to clear the upper register bits when emitting code for i32 WASM return values. Leftover bits from prior operations remained in the high half of the register. When SpiderMonkey later interpreted the result, the polluted value could be treated as a tagged pointer or another type, producing a type confusion condition [CWE-843].

Root Cause

The root cause is improper register width handling in the WebAssembly JIT backend. The compiler assumed the high bits of the destination register were already clean when generating return-value code. That assumption did not hold across all calling paths, allowing uninitialized bits to leak into the logical i32 value consumed by JavaScript or subsequent WASM operations.

Attack Vector

Exploitation requires a victim to load a web page or render HTML email content that delivers a crafted WebAssembly module. The attacker hosts malicious JavaScript that instantiates the module and invokes a function returning a controlled i32. By shaping prior register state, the attacker influences the leftover bits, then forces the JIT-compiled return value to be reused where strict type assumptions exist, triggering memory corruption. No authentication is required, but user interaction is needed to load the attacker-controlled content.

No public proof-of-concept exploit code is available for this issue. Refer to the Mozilla Bug Report #1946004 for technical context.

Detection Methods for CVE-2025-1933

Indicators of Compromise

• Unexpected Firefox or Thunderbird content process crashes with signatures referencing js::jit, wasm, or BaselineCompiler frames
• Browser telemetry showing repeated WASM compilation failures or asserts on 64-bit endpoints
• Outbound network connections from firefox.exe or thunderbird.exe to recently registered domains immediately after loading WASM-heavy pages

Detection Strategies

• Inventory installed Firefox, Firefox ESR, and Thunderbird builds across managed endpoints and flag any version below the fixed releases
• Hunt for child processes spawned by firefox.exe or thunderbird.exe such as cmd.exe, powershell.exe, or shells, which are abnormal for the browser content sandbox
• Correlate browser crash dumps with web proxy logs to identify URLs serving WebAssembly content at the time of the crash

Monitoring Recommendations

• Centralize browser crash and update telemetry in a SIEM or data lake to detect version drift and exploitation attempts
• Monitor EDR process-tree events for unusual code execution branching from Firefox or Thunderbird content processes
• Track outbound DNS and HTTP requests from browser processes to low-reputation domains hosting .wasm payloads

How to Mitigate CVE-2025-1933

Immediate Actions Required

• Upgrade Firefox to version 136 or later on all 64-bit systems
• Upgrade Firefox ESR to 115.21 or 128.8, depending on the deployed branch
• Upgrade Thunderbird to 136 or 128.8 to address the same JIT defect in mail rendering
• Enforce automatic browser updates through enterprise policy to prevent regression

Patch Information

Mozilla addressed the issue in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. See the Mozilla Security Advisory MFSA-2025-14, MFSA-2025-15, MFSA-2025-16, MFSA-2025-17, and MFSA-2025-18. Debian users should apply the updates referenced in the Debian LTS Announcement March 2025.

Workarounds

• Disable WebAssembly via the javascript.options.wasm preference in about:config where business needs allow
• Restrict execution of untrusted web content through enterprise policy or browser isolation until patches are deployed
• Block known malicious domains hosting hostile WASM payloads at the web proxy or DNS layer

# Disable WebAssembly in Firefox as a temporary mitigation
# Edit the enterprise policies.json file
{
  "policies": {
    "Preferences": {
      "javascript.options.wasm": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}