External risk intelligence

Firefox and Thunderbird Use-after-free in WebRTC Signaling

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-14321

This vulnerability affects client-side web browsers and email clients (Firefox and Thunderbird). These applications are user-controlled endpoints rather than server-side, internet-facing services, gateways, or infrastructure. Vulnerabilities in client software are typically triggered by user interaction with malicious content rather than direct exposure of a public-facing network service.

Use After Free

Mozilla Firefox

before 140.6.0before 146.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in the WebRTC Signaling component could allow for the execution of malicious code. This issue affects certain versions of Firefox and Thunderbird. The main concern is confirming relevance and exposure given the client-side nature of the affected applications.

A flaw exists in communication features.
This issue could impact user data security.
Confirm if our teams use affected software.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic targeting the WebRTC signaling component. This traffic could cause a use-after-free condition within the component, potentially leading to serious security consequences.

Triggered by network traffic.
Involves WebRTC signaling.
Leads to code execution risk.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the WebRTC signaling component could allow an attacker to execute arbitrary code. This could happen when a user interacts with specially crafted web content or emails that trigger the vulnerability in affected Firefox or Thunderbird clients.

System data could be compromised.
Malicious content could trigger the vulnerability.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the WebRTC: Signaling component affects Firefox and Thunderbird. The first practical step is for application owners or platform teams to inventory all instances of these products, confirm exposure and business criticality, and then coordinate with the vendor for remediation planning during a maintenance window.

Application owners should manage this issue.
Verify product deployment and reachability first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WebRTC component in Firefox and Thunderbird?

WebRTC, or Web Real-Time Communication, is a technology embedded in Firefox and Thunderbird that enables direct, peer-to-peer data sharing. It powers features like browser-based video conferencing, voice calls, and real-time file transfers without requiring additional plugins or external software installations.

How does CVE-2025-14321 represent a use-after-free weakness?

This vulnerability involves a memory management error known as a use-after-free, classified as CWE-416. It occurs when the software continues to use a memory address after that memory has been cleared or released. If an attacker directs the application to use this invalid memory location, it can result in unpredictable behavior, including the potential to run unauthorized code.

Do I need to be actively on a call for this to be triggered?

Not necessarily. While the vulnerability exists in the WebRTC signaling component, it does not require an active peer-to-peer connection or call to be in progress. The flaw is triggered when the application processes specially crafted network traffic or content designed to interact with the signaling mechanism, which can happen simply by visiting a malicious webpage or viewing certain emails.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that this risk is very unlikely to affect traditional infrastructure. Because Firefox and Thunderbird are client-side applications rather than server-side services, they do not present the typical internet-facing attack surface of a gateway or public server. Risk primarily depends on individual user interaction with untrusted digital content.

When should I update to resolve this vulnerability?

You should prioritize updating as soon as possible. Since this vulnerability is critical, the immediate practical step is to verify which versions of Firefox and Thunderbird are running in your environment. Once identified, coordinate a standard update to version 146 or 140.6 ESR, which contains the vendor's official fix for this memory flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.