This Red Hat security advisory addresses 13 distinct vulnerabilities in Mozilla Firefox, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities cover a range of issues such as spoofing in the Downloads Panel and DOM components, use-after-free bugs in JavaScript and IPC components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components, information disclosure in Networking and PDF Viewer components, mitigation bypass in DOM security, and clickjacking. The fixes are included in Firefox ESR 140.7 and Firefox 147 packages for Red Hat Enterprise Linux 9.2 and related distributions. The advisory is rated as Important by Red Hat Product Security.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause memory corruption (use-after-free), escape sandbox restrictions, disclose sensitive information, and perform clickjacking attacks. These impacts could compromise the security and integrity of the Firefox browser environment on affected Red Hat Enterprise Linux systems. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_2 and Firefox 147) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 and related distributions should apply these official updates promptly to remediate the security issues. Detailed update instructions are available in the Red Hat advisory RHSA-2026:2044 at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.