JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
https://www.mozilla.org/security/advisories/mfsa2025-96/
https://www.mozilla.org/security/advisories/mfsa2025-95/
https://www.mozilla.org/security/advisories/mfsa2025-94/