This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes caused by use-after-free (CVE-2025-10527) and undefined behavior with invalid pointers (CVE-2025-10528) in the Graphics Canvas2D component, a same-origin policy bypass (CVE-2025-10529) in the Layout component, incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532), integer overflow in the SVG component (CVE-2025-10533), information disclosure in the Networking Cache component (CVE-2025-10536), and memory safety bugs (CVE-2025-10537). These vulnerabilities affect specific versions of Firefox and Thunderbird distributed with Red Hat Enterprise Linux 8.4 and have been fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. The advisory provides official patches to remediate these issues.

The vulnerabilities include sandbox escapes, which could allow an attacker to break out of restricted execution environments, same-origin policy bypasses that could enable unauthorized access to web content, memory safety bugs that may lead to crashes or code execution, information disclosure that could leak sensitive data, and integer overflow that might cause unexpected behavior. These issues collectively pose a high security risk to users of affected Firefox and Thunderbird versions on Red Hat Enterprise Linux 8.4.

Red Hat has released official security updates for Firefox and Thunderbird in Red Hat Enterprise Linux 8.4 that address all listed vulnerabilities. Users should apply these updates promptly to mitigate the risks. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated beyond applying the official patches.