This advisory covers three security fixes in Mozilla Firefox distributed with Red Hat Enterprise Linux 10. The vulnerabilities include CVE-2026-8090, a use-after-free in the DOM networking component; CVE-2026-8092, memory safety bugs fixed in ESR 115.35.2, ESR 140.10.2, and Firefox 150.0.2; and CVE-2026-8094, an issue in the WebRTC component. These bugs could potentially lead to security issues such as memory corruption. Red Hat has issued updated Firefox packages (version 140.10.2-1.el10_2) for multiple architectures including x86_64, s390x, ppc64le, and aarch64 to address these vulnerabilities. The advisory is classified as Important with a high severity rating, though no CVSS scores are provided. No known exploits in the wild have been reported at this time.

The vulnerabilities fixed include use-after-free and memory safety bugs, which could allow an attacker to cause memory corruption potentially leading to arbitrary code execution or denial of service. The WebRTC component issue may also affect browser security. The impact is rated as high severity by Red Hat Product Security. No known exploits in the wild have been reported, reducing immediate risk but the vulnerabilities remain critical to patch.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the Firefox update to version 140.10.2-1.el10_2 or later as provided by Red Hat to remediate these issues. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.