CVE-2023-25751

What it actually does

Invalid JIT code invalidation during iterator following allows newly generated code to be overwritten incorrectly, resulting in memory corruption that can trigger a crash.

Why it matters to the business

Affected browser users face potential denial of service from crashes; limited risk of remote code execution on unpatched systems that have not been updated in over three years.

How an attack unfolds

An attacker hosts a malicious page that forces JIT compilation paths involving iterators, triggers invalidation at the right moment, and causes the engine to write over freshly emitted code, leading to a crash that may be turned into code execution.

How to fix it

Upgrade Firefox to version 111 or later, Firefox ESR to 102.9 or later, and Thunderbird to 102.9 or later. For affected Git packages apply the commits listed in the fixed_versions (6c6da2672849c1f0ca41efec67bea8391615cd69 and 9aba21e291dbfc44b1b715a1f24259ae937725db).

How to confirm the fix worked

Confirm the installed browser or package reports a version at or above the fixed releases and that the JIT-related crash signature no longer reproduces under targeted test cases.

Typical attack path

1. Deliver malicious content via a web page or email attachment
2. Force the browser's JIT compiler to generate code while an iterator is active
3. Induce invalidation so the replacement code region is incorrectly overwritten
4. Trigger the resulting memory corruption to produce a crash or attempt further exploitation

How to detect it

Search browser crash logs and telemetry for JIT invalidation faults; correlate with web request logs to pages that trigger iterator-heavy JavaScript workloads.

What your security team should do

• Prioritize patching all browser instances to the fixed versions within normal change windows
• Block or sandbox untrusted web content until patches are deployed
• Review crash telemetry for JIT-related faults as an early indicator of exposure