Red Hat Product Security issued an advisory (RHSA-2025:22368) for Mozilla Firefox addressing nine distinct vulnerabilities (CVE-2025-13012 through CVE-2025-13020). The issues include a race condition in the Graphics component, multiple use-after-free vulnerabilities in Audio/Video and WebRTC components, same-origin policy bypasses in DOM Workers and Notifications components, mitigation bypasses in DOM Security and Core & HTML components, incorrect boundary conditions in the JavaScript WebAssembly component, and a spoofing vulnerability. These vulnerabilities collectively impact Firefox's security posture by potentially allowing bypasses of security mechanisms and memory corruption. The advisory provides updated Firefox packages for Red Hat Enterprise Linux 8.6 variants, including Extended Update Support, Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The vendor rates the update as Important but does not provide CVSS scores within the advisory itself. The advisory references Red Hat's article for update application instructions and lists specific package versions fixed at firefox-140.5.0-1.el8_6.

The vulnerabilities collectively pose a high security risk by enabling potential mitigation bypasses, use-after-free memory corruption, race conditions, same-origin policy bypasses, and spoofing attacks within Firefox. These issues could allow attackers to circumvent security controls, execute unauthorized code, or spoof content, impacting confidentiality, integrity, and user trust. The advisory rates the impact as Important, indicating significant but not critical severity. No known exploits in the wild are reported at this time.

Red Hat has released updated Firefox packages (version 140.5.0-1.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described vulnerabilities. No additional mitigation steps are indicated or required beyond applying the vendor-provided update.