Red Hat Product Security issued an advisory (RHSA-2026:0667) for Mozilla Firefox on Red Hat Enterprise Linux 8, addressing 13 security vulnerabilities. These include a spoofing issue in the Downloads Panel (CVE-2025-14327), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs fixed in Firefox ESR 140.7 and Thunderbird ESR 140.7 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and spoofing and clickjacking issues in DOM and PDF Viewer components (CVE-2026-0890). The update is available for multiple architectures of Red Hat Enterprise Linux 8 and fixes these vulnerabilities in Firefox ESR 140.7 and Firefox 147 versions.

The vulnerabilities fixed include spoofing, use-after-free leading to potential memory corruption, sandbox escapes which could allow code execution outside of restricted environments, information disclosure, mitigation bypasses, and clickjacking. These issues could allow attackers to manipulate browser behavior, execute arbitrary code, bypass security mitigations, or disclose sensitive information. The update addresses these risks by patching the affected components, thereby improving the security posture of Firefox on Red Hat Enterprise Linux 8.

Red Hat has released an official security update for Firefox ESR 140.7 on Red Hat Enterprise Linux 8 that addresses all listed vulnerabilities. Users should apply the update promptly by following Red Hat's update instructions at https://access.redhat.com/articles/11258. This update is the official fix and mitigates the vulnerabilities described. No additional mitigation steps are required beyond applying the update.