This advisory covers four security vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 9. The issues include memory safety bugs (CVE-2026-7322, CVE-2026-7323), an information disclosure vulnerability caused by incorrect boundary conditions in the Audio/Video component (CVE-2026-7320), and a sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC networking component (CVE-2026-7321). These vulnerabilities affect Firefox ESR 140.10.1, Firefox 150.0.1, Thunderbird ESR 140.10.1, and Thunderbird 150.0.1. Red Hat has released updated packages to fix these issues, which are available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory references Red Hat's errata RHSA-2026:19370 and directs users to apply the updates as per Red Hat's guidance.

The vulnerabilities include memory safety bugs that could lead to crashes or potential code execution, information disclosure from incorrect boundary checks in the Audio/Video component, and a sandbox escape vulnerability in the WebRTC networking component. These issues could compromise the confidentiality and integrity of user data or allow an attacker to escape sandbox restrictions. Red Hat classifies the security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Firefox and Thunderbird packages (e.g., firefox-140.10.1-1.el9_8) that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's published instructions at https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires manual update by system administrators. No additional mitigations or workarounds are specified in the advisory.