Red Hat Product Security issued an advisory (RHSA-2025:12046) for Mozilla Firefox and Thunderbird vulnerabilities affecting Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The update addresses nine CVEs (CVE-2025-8027 through CVE-2025-8035) covering issues such as a large branch table leading to truncated instructions, multiple memory safety bugs, incorrect URL stripping in Content Security Policy (CSP) reports, partial return values written to the stack by the JavaScript engine, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass via XSLT documents, and execution of javascript: URLs on object and embed tags. The advisory does not provide CVSS scores but rates the security impact as important. The update is available for Red Hat Enterprise Linux 9.0 on ppc64le, x86_64, aarch64, and s390x architectures.

These vulnerabilities collectively impact the security of Firefox and Thunderbird by potentially allowing memory corruption, bypassing security policies like CSP, and enabling user-assisted code execution. Exploitation could lead to arbitrary code execution or other security breaches within affected applications. The advisory does not report known exploits in the wild.

Red Hat has released an official security update for Firefox and Thunderbird as part of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.