This advisory covers several security vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of some non-writable Object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior on web resources without a content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These vulnerabilities have been addressed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144. Red Hat has released updated packages for Red Hat Enterprise Linux 8.6 variants to remediate these issues.

The vulnerabilities include memory safety issues such as use-after-free and out-of-bounds read/write, which can lead to crashes or potentially arbitrary code execution. Cross-process information leaks may expose sensitive data across process boundaries. Modification of non-writable object properties and override of browser behavior via OBJECT tag attributes can lead to unexpected or unsafe browser behavior. These issues collectively pose a high security risk if exploited.

Red Hat has released updated Firefox packages (version 140.4.0-3.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.