Red Hat Product Security issued an advisory (RHSA-2026:0006) for Firefox security updates addressing ten CVEs (CVE-2025-14321 through CVE-2025-14333) affecting Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The vulnerabilities include use-after-free in WebRTC signaling, multiple JIT miscompilation flaws in the JavaScript engine, sandbox escape via incorrect boundary conditions in the CanvasWebGL graphics component, privilege escalation in Netmonitor and DOM Notifications components, same-origin policy bypass in request handling, and memory safety bugs. These issues collectively represent significant security risks and have been fixed in the updated packages provided by Red Hat for RHEL 8.4 Extended Update Support and Advanced Update Support.

The vulnerabilities fixed include memory safety bugs, use-after-free conditions, sandbox escape, privilege escalation, and same-origin policy bypass, which could allow attackers to execute arbitrary code, escalate privileges, bypass security policies, or escape sandbox restrictions. These issues affect core browser components and could compromise the confidentiality, integrity, and security of affected systems if exploited. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the provided patches.