This Red Hat security advisory addresses thirteen distinct vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities encompass spoofing issues, use-after-free bugs in JavaScript and IPC components, memory safety bugs, sandbox escape vulnerabilities due to incorrect boundary conditions and integer overflows in graphics components, information disclosure in networking and PDF viewer components, mitigation bypass in DOM security, and clickjacking issues. These flaws affect Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 versions distributed with Red Hat Enterprise Linux 9.0. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively pose risks including potential spoofing attacks, memory corruption leading to use-after-free conditions, sandbox escapes allowing code execution outside restricted environments, information disclosure of sensitive data, mitigation bypasses of security controls, and clickjacking attacks. These impacts could compromise browser security, user privacy, and system integrity if exploited. The Red Hat advisory rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_0) for Red Hat Enterprise Linux 9.0 across multiple architectures (x86_64, ppc64le, aarch64, s390x) that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided security update.