This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, JIT miscompilation, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in Graphics ImageLib, same-origin policy bypass, use-after-free in Networking HTTP, and incorrect boundary conditions in multiple components. The vulnerabilities affect Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 running on Red Hat Enterprise Linux 10. The update fixes these issues by patching the affected components to prevent exploitation. The advisory rates the security impact as Important (high severity).

The vulnerabilities collectively allow for potential sandbox escapes, information disclosure, privilege escalation, denial-of-service, and memory safety issues in Firefox and Thunderbird on Red Hat Enterprise Linux 10. These could lead to unauthorized code execution, data leaks, application crashes, or bypass of security mitigations. The CVSS vector for CVE-2026-12289 indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. The overall impact is high, affecting the confidentiality, integrity, and availability of the affected applications.

A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 10, specifically firefox-0:140.12.0-1.el10_2.x86_64 and related packages. Users should apply this update promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.