This Red Hat security advisory addresses a set of 13 vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and multiple CVEs from 2026. The vulnerabilities span several components: spoofing in the Downloads Panel and DOM Copy & Paste/Drag & Drop, use-after-free bugs in the JavaScript garbage collector, IPC, and JavaScript engine, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components, information disclosure in Networking and PDF Viewer components, mitigation bypass in the DOM Security component, and clickjacking issues. These vulnerabilities have been fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147, and the fixes are included in the Red Hat Enterprise Linux 7 Extended Lifecycle Support update.

The vulnerabilities collectively could allow attackers to perform spoofing, execute use-after-free exploits potentially leading to arbitrary code execution, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts affect the security and privacy of users running the affected Firefox and Thunderbird versions on Red Hat Enterprise Linux 7 Extended Lifecycle Support. The severity is rated as high by Red Hat Product Security.

Red Hat has released an official security update for Firefox ESR 140.7 and Thunderbird ESR 140.7 as part of Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the update promptly to remediate these vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update is the recommended mitigation.