Red Hat Security Advisory: firefox security update
Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird, including memory safety bugs, use-after-free, JIT miscompilation, sandbox escape, privilege escalation, and same-origin policy bypass. These issues affect Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The vulnerabilities impact various components such as WebRTC signaling, JavaScript engine JIT, graphics CanvasWebGL, Netmonitor, request handling, and DOM notifications. Red Hat has issued an important security advisory with updates available for affected Red Hat Enterprise Linux 8.2 systems.
AI Analysis
Technical Summary
This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14321 (use-after-free in WebRTC signaling), CVE-2025-14322 (sandbox escape in CanvasWebGL), CVE-2025-14323 (privilege escalation in DOM notifications), CVE-2025-14324, CVE-2025-14325, CVE-2025-14330 (JIT miscompilation in JavaScript engine), CVE-2025-14328, CVE-2025-14329 (privilege escalation in Netmonitor), CVE-2025-14331 (same-origin policy bypass), and CVE-2025-14333 (memory safety bugs). The advisory covers fixes in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Red Hat Enterprise Linux 8.2 users are advised to update to the patched Firefox packages provided in the advisory RHSA-2026:0005. The vulnerabilities span multiple components and could lead to privilege escalation, sandbox escape, and policy bypass if exploited.
Potential Impact
The vulnerabilities collectively could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, bypass same-origin policy, and cause memory safety issues. These impacts could compromise the confidentiality, integrity, and availability of systems running affected Firefox and Thunderbird versions. The advisory rates the security impact as Important, indicating significant risk if unpatched.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.2 (firefox-140.6.0-1.el8_2) that address these vulnerabilities. Users should apply these official patches promptly following Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are specified or required beyond applying the vendor-provided updates.
Red Hat Security Advisory: firefox security update
Description
Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird, including memory safety bugs, use-after-free, JIT miscompilation, sandbox escape, privilege escalation, and same-origin policy bypass. These issues affect Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The vulnerabilities impact various components such as WebRTC signaling, JavaScript engine JIT, graphics CanvasWebGL, Netmonitor, request handling, and DOM notifications. Red Hat has issued an important security advisory with updates available for affected Red Hat Enterprise Linux 8.2 systems.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14321 (use-after-free in WebRTC signaling), CVE-2025-14322 (sandbox escape in CanvasWebGL), CVE-2025-14323 (privilege escalation in DOM notifications), CVE-2025-14324, CVE-2025-14325, CVE-2025-14330 (JIT miscompilation in JavaScript engine), CVE-2025-14328, CVE-2025-14329 (privilege escalation in Netmonitor), CVE-2025-14331 (same-origin policy bypass), and CVE-2025-14333 (memory safety bugs). The advisory covers fixes in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Red Hat Enterprise Linux 8.2 users are advised to update to the patched Firefox packages provided in the advisory RHSA-2026:0005. The vulnerabilities span multiple components and could lead to privilege escalation, sandbox escape, and policy bypass if exploited.
Potential Impact
The vulnerabilities collectively could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, bypass same-origin policy, and cause memory safety issues. These impacts could compromise the confidentiality, integrity, and availability of systems running affected Firefox and Thunderbird versions. The advisory rates the security impact as Important, indicating significant risk if unpatched.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.2 (firefox-140.6.0-1.el8_2) that address these vulnerabilities. Users should apply these official patches promptly following Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are specified or required beyond applying the vendor-provided updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0005
- Cve Count
- 10
- Additional Cves
- ["CVE-2025-14322","CVE-2025-14323","CVE-2025-14324","CVE-2025-14325","CVE-2025-14328","CVE-2025-14329","CVE-2025-14330","CVE-2025-14331","CVE-2025-14333"]
Threat ID: 6a4049df27e9c79719831b3b
Added to database: 06/27/2026, 22:08:31 UTC
Last enriched: 06/27/2026, 22:27:11 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.