This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), integer overflow (CVE-2025-10533), and incorrect boundary conditions in the JavaScript garbage collector (CVE-2025-10532). These vulnerabilities impact the Graphics Canvas2D, Layout, Networking Cache, SVG, and JavaScript GC components. The issues are fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. The advisory applies to Red Hat Enterprise Linux Server Extended Lifecycle Support 7 on multiple architectures. No CVSS scores are provided in the advisory.

The vulnerabilities include sandbox escapes which could allow attackers to break out of restricted execution environments, a same-origin policy bypass which could enable unauthorized access to web content, memory safety bugs that may lead to crashes or code execution, information disclosure that could leak sensitive data, and an integer overflow that could cause unexpected behavior. These issues collectively represent a high security impact as rated by Red Hat Product Security.

A security update is available and should be applied to affected systems. The update fixes the vulnerabilities in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. Users of Red Hat Enterprise Linux Server Extended Lifecycle Support 7 should upgrade to these versions or later to remediate the issues. Refer to the Red Hat advisory RHSA-2025:17453 and https://access.redhat.com/articles/11258 for detailed update instructions.