This Red Hat security advisory covers a broad set of vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass. The affected components span the JavaScript engine, graphics (Canvas2D, WebRender, Text), audio/video (Web Codecs, GMP, Playback), WebRTC signaling, XPCOM, CSS parsing, layout, networking HTTP, widget Cocoa, telemetry, and responsive design mode. These vulnerabilities are fixed in Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149 as packaged for Red Hat Enterprise Linux 10. The advisory rates the update as important with high severity and provides detailed bugzilla references for each fix.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, escape sandbox restrictions, cause denial-of-service conditions, or disclose sensitive information when users run affected versions of Firefox or Thunderbird. The broad range of affected components and issue types indicates multiple attack vectors and potential impacts on confidentiality, integrity, and availability of the affected software.

Red Hat has released updated packages for Firefox and Thunderbird in Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the official Red Hat security update RHSA-2026:5931 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the provided patches.