Why is Math.floor(Math.random()*9000) not secure in JavaScript? I heard that one can predict the output from Math.Random() of JavaScript, but another day I had an idea to combine Math.random() with Math.floor() to make it harder to predict, but a week ago I saw one user claimed that he can predict even if I used Math.floor() and that only takes 14 sample values to do that. 

How is it possible mathematically? 



The concrete construction in question is Math.floor(Math.random()*9000)+1000.

Various API specifications are here and there. Per this answer most browsers use Xorshift128+, possibly derived from this C source code.

In this comment the OP suggests that the question is about "Chrome's V8 implementation" and links to a Chromium commit.
According to this answer, math.random uses a Linear Congruential Generator (although it is not clear to me if that's on one specific browser, or on all JavaScript implementations).

In any case, a Linear Congruential Generator is known not to be secure, in the sense that, given partial output (which the Math.floor( 9000 * Math.random() ) operation allows), someone is able to reconstruct the initial seed, and from that, reconstruct the entire sequence.

In particular, if the browser uses the popular XORSHIFT128+ RNG, and you are able to deduce 128 lsbits from the underlying 32 bit outputs, you can reconstruct the initial state (by solving some binary linear equations).