Red Hat Product Security released an important security advisory (RHSA-2026:0694) addressing 13 distinct vulnerabilities in Mozilla Firefox and Thunderbird packages for Red Hat Enterprise Linux 9. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These vulnerabilities affect Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption leading to potential code execution or crashes (use-after-free), sandbox escapes that could allow attackers to break out of restricted environments, information disclosure that could leak sensitive data, mitigation bypasses weakening security controls, and clickjacking attacks. These issues affect core browser components and extensions, potentially impacting confidentiality, integrity, and availability of affected systems running the vulnerable Firefox and Thunderbird versions on Red Hat Enterprise Linux 9.

Red Hat has released updated Firefox and Thunderbird packages (e.g., firefox-140.7.0-1.el9_7) for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official security updates promptly by following Red Hat's update instructions at https://access.redhat.com/articles/11258. This update is rated as Important by Red Hat Product Security. No additional mitigations are specified beyond applying the provided patches.