This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in the Graphics ImageLib component, and same-origin policy bypass in the Networking Cookies component. The fixes apply to Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 versions distributed with Red Hat Enterprise Linux 8. The vulnerabilities span multiple CWE categories such as CWE-266 (Privilege Escalation), CWE-787 (Out-of-bounds Write), CWE-823 (Use After Free), and others. The advisory is identified as RHSA-2026:27717 and rates the update as having an Important security impact.

The vulnerabilities could allow attackers to escape sandbox restrictions, disclose sensitive information, escalate privileges, cause denial-of-service conditions, bypass mitigations, and violate same-origin policies. These impacts affect the security boundaries and memory safety of Firefox and Thunderbird, potentially compromising confidentiality, integrity, and availability of affected systems. The severity is rated high by the source, reflecting significant risk if unpatched.

A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 8, including ESR 140.12 and version 152 releases. Users should apply the update as per Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these vulnerabilities. The advisory RHSA-2026:27717 provides detailed instructions. No indication of no-action or partial mitigation is stated; therefore, applying the official update is recommended.