This Red Hat security advisory addresses seven distinct vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-10527 (sandbox escape via use-after-free in Graphics Canvas2D), CVE-2025-10528 (sandbox escape due to undefined behavior and invalid pointer in Graphics Canvas2D), CVE-2025-10529 (same-origin policy bypass in Layout component), CVE-2025-10532 (incorrect boundary conditions in JavaScript GC), CVE-2025-10533 (integer overflow in SVG component), CVE-2025-10536 (information disclosure in Networking Cache), and CVE-2025-10537 (memory safety bugs). These vulnerabilities affect versions prior to Firefox ESR 140.3 and Firefox 143, and corresponding Thunderbird versions. The advisory provides patches to remediate these issues on Red Hat Enterprise Linux 10 and related variants.

The vulnerabilities include sandbox escapes, which could allow attackers to break out of restricted execution environments, a same-origin policy bypass that could enable unauthorized access to web content, memory safety bugs that may lead to crashes or code execution, information disclosure exposing sensitive data, and integer overflow potentially causing unexpected behavior. These issues collectively pose a high security risk to users of affected Firefox and Thunderbird versions on Red Hat Enterprise Linux 10.

A security update is available and should be applied promptly. Red Hat has released patched versions Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143 for Red Hat Enterprise Linux 10 and its variants. Users should follow Red Hat's official update instructions at https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigations are indicated by the vendor advisory.