Red Hat Product Security issued an advisory (RHSA-2026:10757) addressing 25 CVEs affecting Firefox and Thunderbird on Red Hat Enterprise Linux 9. The vulnerabilities span multiple components including NSS libraries, JavaScript engine, DOM, WebRTC, IndexedDB storage, WebAssembly, Graphics (Canvas2D, WebRender), Audio/Video Web Codecs, and others. Issues include use-after-free, incorrect boundary conditions, privilege escalation, mitigation bypass, and information disclosure due to uninitialized memory. These vulnerabilities were fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150, and Thunderbird 150 packages. The advisory provides updated packages and references CVE pages for detailed impact and scoring information.

The vulnerabilities collectively pose risks such as potential privilege escalation, information disclosure, spoofing, and memory safety issues that could be exploited to compromise the affected Firefox and Thunderbird applications. The Red Hat advisory rates the update as having an Important security impact. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:10757 (https://access.redhat.com/articles/11258) to remediate the issues. Since this is an official Red Hat security advisory with updated packages available, applying the vendor-provided update is the recommended mitigation.