This Red Hat security advisory addresses a series of vulnerabilities in Mozilla Firefox affecting Red Hat Enterprise Linux 8. The vulnerabilities include a spoofing issue in the Downloads Panel (CVE-2025-14327), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs fixed in Firefox ESR 140.7 and Thunderbird ESR 140.7 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM Security (CVE-2026-0877), and spoofing and clickjacking issues in DOM Copy & Paste, Drag & Drop components (CVE-2026-0890). The advisory provides updated Firefox packages for Red Hat Enterprise Linux 8 and its extended life cycle versions to address these issues.

The vulnerabilities collectively impact the security of Firefox users on Red Hat Enterprise Linux 8 by enabling potential spoofing, memory corruption (use-after-free), sandbox escapes, information disclosure, mitigation bypass, and clickjacking attacks. These issues could allow attackers to bypass security controls, execute arbitrary code, disclose sensitive information, or deceive users through spoofed content. The advisory rates the overall security impact as Important (high severity).

Red Hat has released updated Firefox packages (e.g., firefox-140.7.0-1.el8_10) for Red Hat Enterprise Linux 8 and its extended life cycle variants that address all listed vulnerabilities. Users and administrators should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated beyond applying the official patches.