This Red Hat security advisory covers multiple vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), incorrect boundary conditions in JavaScript garbage collection (CVE-2025-10532), and an integer overflow in the SVG component (CVE-2025-10533). These issues affect the Graphics Canvas2D, Layout, Networking Cache, JavaScript GC, and SVG components. The vulnerabilities are fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. Red Hat has released patches for Red Hat Enterprise Linux 8.8 variants to address these issues.

The vulnerabilities include sandbox escapes, which could allow an attacker to break out of the browser's sandbox environment, potentially leading to code execution outside the intended security boundaries. The same-origin policy bypass could allow unauthorized access to data from different origins. Memory safety bugs and integer overflow issues could lead to crashes or exploitable conditions. Information disclosure vulnerabilities could expose sensitive data. Overall, these issues pose a high security risk if left unpatched.

Red Hat has released official security updates that fix these vulnerabilities in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143 for Red Hat Enterprise Linux 8.8 variants. Users and administrators should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the official patches.