This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-10527 (sandbox escape via use-after-free in Graphics Canvas2D), CVE-2025-10528 (sandbox escape due to undefined behavior and invalid pointer in Graphics Canvas2D), CVE-2025-10529 (same-origin policy bypass in Layout), CVE-2025-10532 (incorrect boundary conditions in JavaScript GC), CVE-2025-10533 (integer overflow in SVG), CVE-2025-10536 (information disclosure in Networking Cache), and CVE-2025-10537 (memory safety bugs). These vulnerabilities could allow sandbox escapes, policy bypasses, information disclosure, and memory corruption. The advisory covers fixes applied in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143 on Red Hat Enterprise Linux 9 platforms.

The vulnerabilities collectively pose a high security risk, including potential sandbox escapes that could allow attackers to break out of restricted execution environments, bypasses of the same-origin policy which could lead to unauthorized data access, memory safety issues that may cause crashes or code execution, and information disclosure through the networking cache. These issues affect both Firefox and Thunderbird components on Red Hat Enterprise Linux 9, potentially impacting confidentiality, integrity, and availability of affected systems.

An official security update is available from Red Hat that addresses all listed vulnerabilities. Users should apply the Firefox and Thunderbird updates for Red Hat Enterprise Linux 9 as detailed in Red Hat Advisory RHSA-2025:16108. No additional mitigation steps are required beyond applying the vendor-provided patches.