This advisory covers four security vulnerabilities in Mozilla Firefox and Thunderbird as packaged by Red Hat for Red Hat Enterprise Linux 9. The issues include memory safety bugs (CVE-2026-7323, CVE-2026-7322), an information disclosure vulnerability caused by incorrect boundary conditions in the Audio/Video component (CVE-2026-7320), and a sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC networking component (CVE-2026-7321). These vulnerabilities have been fixed in Firefox ESR 140.10.1 and Firefox 150.0.1, and Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Red Hat has released updated packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64 as part of Red Hat Enterprise Linux 9 and its Extended Update Support releases. The advisory is classified as Important by Red Hat Product Security.

The vulnerabilities include memory safety bugs that could potentially lead to crashes or code execution, information disclosure through incorrect boundary checks in the Audio/Video component, and sandbox escape via WebRTC networking component boundary issues. These issues could allow an attacker to access sensitive information or escape sandbox restrictions, potentially compromising system security. The severity is rated as high by the source data, and Red Hat classifies the update as Important, indicating significant security impact if unpatched.

Red Hat has released updated Firefox and Thunderbird packages (e.g., firefox-140.10.1-1.el9_8) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and related variants should apply these updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches provided by Red Hat.