Red Hat Product Security issued an advisory (RHSA-2026:0694) for Mozilla Firefox distributed with Red Hat Enterprise Linux 9, addressing 13 security vulnerabilities. These include CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components, memory safety bugs fixed in Firefox ESR 140.7 and Thunderbird ESR 140.7 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components, information disclosure in Networking and PDF Viewer components, mitigation bypass in DOM security, and spoofing and clickjacking issues in DOM Copy & Paste, Drag & Drop, and PDF Viewer components. The advisory provides updated Firefox packages to remediate these issues.

The vulnerabilities fixed include spoofing, use-after-free, memory safety bugs, sandbox escapes, information disclosure, mitigation bypass, and clickjacking, which collectively could allow attackers to bypass security controls, disclose sensitive information, execute arbitrary code, or escape sandbox restrictions. The update addresses these issues in Firefox ESR 140.7 and Firefox 147 versions, reducing the risk of exploitation on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_7 and Firefox 147) that fix these vulnerabilities. Users of Red Hat Enterprise Linux 9 and related variants should apply the security update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.