This Red Hat security advisory addresses 13 vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities cover a range of issues such as spoofing in the Downloads Panel and DOM components, use-after-free bugs in the JavaScript engine and IPC components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components, information disclosure in Networking and PDF Viewer components, mitigation bypass in the DOM security component, and clickjacking. These vulnerabilities are fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 packages provided by Red Hat for Red Hat Enterprise Linux 8.2 AUS. The advisory is identified as RHSA-2026:2074 and rates the update as having an Important security impact.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free conditions potentially leading to crashes or code execution, escape sandbox restrictions, disclose sensitive information, and perform clickjacking attacks. These issues affect core browser components and could compromise user security and privacy if exploited. The severity is rated as high by the source, indicating significant risk if unpatched.

Red Hat has released an official security update for Firefox and Thunderbird in Red Hat Enterprise Linux 8.2 AUS (Advanced Update Support) that addresses all listed vulnerabilities. Users should apply the update to Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 packages as provided by Red Hat. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patches.