This Red Hat security advisory (RHSA-2025:12353) covers a set of nine vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-8027 and related CVEs. The issues include memory safety bugs, a large branch table leading to truncated instructions, incorrect URL stripping in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine stack, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass via XSLT documents, and execution of javascript: URLs on object and embed tags. The advisory provides an update for Red Hat Enterprise Linux 8.2 AUS with fixes for these vulnerabilities. No CVSS base scores are included in the advisory; users are directed to the individual CVE pages for detailed scoring. The update is classified as important by Red Hat Product Security.

The vulnerabilities addressed include memory safety issues that could lead to crashes or potentially exploitable conditions, incorrect enforcement of CSP which could allow bypass of security policies, partial writes in the JavaScript engine that could cause unpredictable behavior, and potential user-assisted code execution through specific commands. These issues collectively pose a high security risk by potentially enabling code execution or bypassing security controls in Firefox and Thunderbird. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released an official security update for Firefox in Red Hat Enterprise Linux 8.2 Advanced Update Support that addresses these vulnerabilities. Users should apply this update promptly to remediate the issues. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigations or workarounds are specified in the advisory.