This Red Hat security advisory (RHSA-2026:2070) covers a set of 13 vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 8.6. The issues include spoofing in the Downloads Panel (CVE-2025-14327), multiple use-after-free vulnerabilities in the JavaScript garbage collector, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and spoofing and clickjacking issues in DOM components (CVE-2026-0890). Red Hat has released updated Firefox packages (version 140.7.0-1.el8_6) for affected Red Hat Enterprise Linux 8.6 variants to address these vulnerabilities.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free conditions potentially leading to crashes or code execution, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts affect the security and integrity of the Firefox browser and Thunderbird email client on affected Red Hat Enterprise Linux 8.6 systems. The overall security impact is rated as Important by Red Hat, indicating significant risk if unpatched.

Red Hat has released official security updates for Firefox and Thunderbird addressing all listed vulnerabilities. Users of Red Hat Enterprise Linux 8.6 variants should apply the Firefox ESR 140.7 update (firefox-140.7.0-1.el8_6) and corresponding Thunderbird updates as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerabilities. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.