This advisory covers multiple vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 8. The fixed issues include memory safety bugs (CVE-2026-7322, CVE-2026-7323), an information disclosure vulnerability caused by incorrect boundary conditions in the Audio/Video component (CVE-2026-7320), and a sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC networking component (CVE-2026-7321). These vulnerabilities were addressed in Firefox ESR 140.10.1 and Firefox 150.0.1, and Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Red Hat has released updated packages for multiple architectures and versions of Red Hat Enterprise Linux 8, including Extended Life Cycle versions. The advisory references Red Hat's official errata RHSA-2026:19588 and provides links for applying the update.

The vulnerabilities include memory safety bugs that could lead to crashes or potentially arbitrary code execution, information disclosure through incorrect boundary checks in the Audio/Video component, and a sandbox escape vulnerability in the WebRTC networking component. These issues could allow an attacker to bypass security mechanisms, access sensitive information, or execute code outside of the intended sandbox environment. Red Hat rates the overall security impact as Important, indicating a high severity level but not critical. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox and Thunderbird packages (version 140.10.1-1.el8_10 and 150.0.1) that address these vulnerabilities. Users of Red Hat Enterprise Linux 8 and its Extended Life Cycle variants should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.