This Red Hat security advisory (RHSA-2026:0017) addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14321 (use-after-free in WebRTC signaling), CVE-2025-14322 (sandbox escape in CanvasWebGL), CVE-2025-14323 (privilege escalation in DOM notifications), CVE-2025-14324, CVE-2025-14325, CVE-2025-14330 (JIT miscompilation in JavaScript engine), CVE-2025-14328 and CVE-2025-14329 (privilege escalation in Netmonitor), CVE-2025-14331 (same-origin policy bypass), and CVE-2025-14333 (memory safety bugs). These vulnerabilities affect Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The advisory provides updated Firefox packages for Red Hat Enterprise Linux 9.2 across multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. The vendor advisory confirms that patches are available and should be applied.

The vulnerabilities fixed include memory safety issues, use-after-free conditions, sandbox escape, privilege escalation, and same-origin policy bypass, which could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, or bypass security policies within the Firefox and Thunderbird applications. Successful exploitation could compromise the confidentiality, integrity, or availability of the affected systems running these browsers. The advisory rates the security impact as Important (high severity).

Red Hat has released updated Firefox packages (version 140.6.0-1.el9_2) for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply these official patches promptly to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided updates.