This Red Hat security advisory addresses numerous vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass. These issues affect multiple components such as the JavaScript engine, graphics (Canvas2D, WebRender, Text), audio/video (Web Codecs, GMP, Playback), WebRTC signaling, XPCOM, CSS parsing, layout, and others. The vulnerabilities have been fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The advisory specifically mentions fixes for Red Hat Enterprise Linux 8.2 AUS. Red Hat Product Security rates the update as important, reflecting the high severity of these issues. No known exploits in the wild have been reported at this time.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, escape sandbox restrictions, cause denial-of-service conditions, or disclose sensitive information. The wide range of affected components and types of vulnerabilities indicates a significant risk to the confidentiality, integrity, and availability of systems running affected versions of Firefox and Thunderbird. The issues impact both the browser and email client components, potentially affecting user security and privacy.

A security update is available from Red Hat for Firefox and Thunderbird on Red Hat Enterprise Linux 8.2 AUS. Users should apply the update to Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149 as provided by Red Hat to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:7840 and the article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated beyond applying the official patches.