Red Hat Product Security issued an advisory (RHSA-2025:22367) for Mozilla Firefox addressing nine distinct security vulnerabilities identified by CVE identifiers CVE-2025-13012 through CVE-2025-13020. The vulnerabilities include race conditions in the Graphics component, use-after-free bugs in Audio/Video and WebRTC components, mitigation bypasses in DOM security and core HTML components, same-origin policy bypasses in DOM Workers and Notifications components, incorrect boundary conditions in JavaScript WebAssembly, and a spoofing issue. These flaws affect Firefox versions distributed with Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support. The advisory references updated Firefox packages (version 140.5.0-1.el8_4) that address these issues. No CVSS scores are provided in the advisory, but the overall security impact is rated as Important by Red Hat.

The vulnerabilities collectively could allow attackers to bypass security mitigations, execute use-after-free exploits potentially leading to arbitrary code execution, bypass same-origin policy restrictions, cause race conditions, and perform spoofing attacks. These issues affect core browser components responsible for rendering, media processing, and security enforcement, potentially compromising user security and privacy if exploited.

Red Hat has released updated Firefox packages (version 140.5.0-1.el8_4) for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No indication of alternative mitigations or that no action is required is provided; applying the official update is the recommended remediation.