Red Hat Product Security issued an important security advisory (RHSA-2026:0018) addressing multiple vulnerabilities in Mozilla Firefox and Thunderbird. The vulnerabilities include a use-after-free in the WebRTC signaling component (CVE-2025-14321), memory safety bugs (CVE-2025-14333), JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape via incorrect boundary conditions in the CanvasWebGL graphics component (CVE-2025-14322), privilege escalations in the Netmonitor and DOM Notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), and a same-origin policy bypass in the request handling component (CVE-2025-14331). These vulnerabilities affect Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Red Hat provides updated packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures to address these issues.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, bypass security policies such as the same-origin policy, and escape sandbox restrictions within Firefox and Thunderbird. This may lead to unauthorized access, data exposure, or compromise of the affected systems running these browsers. The advisory rates the security impact as Important (high severity).

Red Hat has released updated Firefox packages (version 140.6.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across supported architectures. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to Red Hat's article at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.