This Red Hat security advisory (RHSA-2026:2043) addresses 13 distinct vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities encompass spoofing in the Downloads Panel and DOM Copy & Paste, use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components, information disclosure in Networking and PDF Viewer components, mitigation bypass in the DOM Security component, and clickjacking issues. The fixes are included in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 packages for Red Hat Enterprise Linux 9.6 Extended Update Support. The advisory provides updated packages and references for applying the security update.

The vulnerabilities fixed in this update could allow attackers to perform spoofing, bypass security mitigations, escape sandbox restrictions, cause use-after-free conditions leading to potential code execution or crashes, disclose sensitive information, and conduct clickjacking attacks. These issues affect core browser components and could compromise user security and privacy if exploited. The severity is rated as high by Red Hat Product Security.

An official security update is available from Red Hat for Red Hat Enterprise Linux 9.6 Extended Update Support, including Firefox ESR 140.7 and Thunderbird ESR 140.7 packages that address these vulnerabilities. Users and administrators should apply the update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the provided patches.