This advisory covers a set of ten security vulnerabilities in Mozilla Firefox and Thunderbird, fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The issues include memory safety bugs (CVE-2025-14333), use-after-free in WebRTC signaling (CVE-2025-14321), multiple JIT miscompilation flaws in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to boundary condition errors in CanvasWebGL (CVE-2025-14322), privilege escalation in Netmonitor and DOM notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), and same-origin policy bypass in request handling (CVE-2025-14331). Red Hat has issued security updates for Red Hat Enterprise Linux 8.8 variants to address these vulnerabilities.

The vulnerabilities collectively allow for potential memory corruption, sandbox escape, privilege escalation, and bypass of same-origin policy protections in Firefox and Thunderbird. These issues could lead to unauthorized code execution, increased privileges, or violation of browser security boundaries if exploited. The advisory rates the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Firefox packages (version 140.6.0-2.el8_8) for Red Hat Enterprise Linux 8.8 and related variants that fix these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.