This Red Hat security advisory (RHSA-2026:2231) addresses 13 distinct vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities span multiple components: spoofing in the Downloads Panel and DOM Copy & Paste/Drag & Drop, use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components, information disclosure in Networking and PDF Viewer components, mitigation bypass in the DOM Security component, and clickjacking issues. These issues are fixed in Firefox ESR 140.7 and Thunderbird ESR 140.7 packages provided for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory provides updated packages and references for remediation.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass mitigations, escape sandbox restrictions, disclose sensitive information, cause use-after-free memory corruption, and execute clickjacking attacks. These issues affect core browser components and could compromise browser security and user data confidentiality. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated Firefox and Thunderbird packages (version 140.7.0-1.el7_9) for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.