This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes caused by use-after-free (CVE-2025-10527) and invalid pointer dereference (CVE-2025-10528) in the Graphics Canvas2D component, a same-origin policy bypass in the Layout component (CVE-2025-10529), incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532), integer overflow in the SVG component (CVE-2025-10533), information disclosure in the Networking Cache component (CVE-2025-10536), and various memory safety bugs (CVE-2025-10537). These vulnerabilities affect Red Hat Enterprise Linux 8 versions prior to 140.3 and 143.1 and have been fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143.

The vulnerabilities include sandbox escapes, which could allow an attacker to break out of restricted execution environments, a same-origin policy bypass potentially enabling unauthorized access to web content, memory safety bugs that could lead to crashes or code execution, information disclosure exposing sensitive data, and integer overflow which could cause unexpected behavior. These issues collectively pose a high security risk to affected systems running vulnerable versions of Firefox and Thunderbird on Red Hat Enterprise Linux 8.

A security update is available and should be applied to affected systems. Red Hat has released fixed packages for Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. Users should update to these versions or later to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.