Red Hat issued a security advisory (RHSA-2026:2074) for Firefox and Thunderbird packages on Red Hat Enterprise Linux 8.2 AUS, addressing 13 distinct vulnerabilities. These include CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free flaws in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), spoofing in DOM copy & paste and drag & drop (CVE-2026-0890), and memory safety bugs (CVE-2026-0891). The advisory references fixes in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. Red Hat rates the update as important and provides updated packages for affected versions.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free memory corruption, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These issues affect core browser components and could undermine browser security and user privacy if exploited. The advisory does not report known exploits in the wild at the time of publication.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:2074 and the linked article https://access.redhat.com/articles/11258. This update fixes the listed CVEs and mitigates the associated risks. No additional vendor-recommended mitigations or workarounds are indicated.