This Red Hat security advisory covers numerous vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free bugs, memory safety issues, privilege escalation, sandbox escapes, and incorrect boundary conditions in multiple components like the JavaScript engine, graphics (Canvas2D, WebRender, Text), audio/video (Web Codecs, GMP, playback), WebRTC signaling, XPCOM, and others. The advisory references fixes in Firefox ESR 115.34, ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149. The update is provided for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures. The vulnerabilities collectively pose a high security impact and have been addressed by Red Hat in this update.

The vulnerabilities include memory corruption (use-after-free, uninitialized memory), privilege escalation, sandbox escapes, information disclosure, denial-of-service, and mitigation bypasses. These issues could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, or cause application crashes. The impact affects core browser and email client components, potentially compromising confidentiality, integrity, and availability of affected systems running vulnerable versions of Firefox and Thunderbird on Red Hat Enterprise Linux 9.0.

A security update for Firefox and Thunderbird is available from Red Hat for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Users should apply the update as described in the Red Hat advisory RHSA-2026:7839 (https://access.redhat.com/errata/RHSA-2026:7839) and the related article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigations are specified beyond applying the official update.