Red Hat issued an important security advisory (RHSA-2025:21281) for Firefox on Red Hat Enterprise Linux 10, addressing nine distinct vulnerabilities (CVE-2025-13012 to CVE-2025-13020). The flaws include a race condition in the Graphics component, multiple use-after-free vulnerabilities in Audio/Video and WebRTC components, mitigation bypasses in DOM security and core HTML components, same-origin policy bypasses in DOM Workers and Notifications components, incorrect boundary conditions in JavaScript WebAssembly, and a spoofing issue. These vulnerabilities affect Firefox version 140.5.0-2.el10_1 packages across x86_64, s390x, ppc64le, and aarch64 architectures. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively could allow attackers to bypass security mitigations, execute use-after-free exploits potentially leading to arbitrary code execution or crashes, bypass same-origin policy restrictions, cause race conditions affecting stability, and perform spoofing attacks. The overall security impact is rated as Important by Red Hat, indicating significant risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released updated Firefox packages (version 140.5.0-2.el10_1) for Red Hat Enterprise Linux 10 and its Extended Update Support variants that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described vulnerabilities.