This Red Hat security advisory (RHSA-2026:2047) addresses a set of 13 vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The vulnerabilities span multiple components such as Downloads Panel, JavaScript garbage collection, sandbox boundary conditions in graphics components, IPC, networking, DOM security, and PDF viewer. The issues include spoofing, use-after-free, memory safety bugs, sandbox escapes, information disclosure, mitigation bypass, and clickjacking. These vulnerabilities are fixed in Firefox ESR 140.7 and Firefox 147, as well as Thunderbird ESR 140.7 and Thunderbird 147, distributed via Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free conditions leading to potential code execution, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. The advisory indicates that the update fixes the listed issues; therefore, applying the official update is the recommended remediation.