This Red Hat security advisory (RHSA-2026:0016) addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-14321 (use-after-free in WebRTC signaling), CVE-2025-14322 (sandbox escape in Graphics CanvasWebGL), CVE-2025-14323 (privilege escalation in DOM Notifications), CVE-2025-14324, CVE-2025-14325, CVE-2025-14330 (JIT miscompilation in JavaScript engine), CVE-2025-14328 and CVE-2025-14329 (privilege escalation in Netmonitor), CVE-2025-14331 (same-origin policy bypass), and CVE-2025-14333 (memory safety bugs). These vulnerabilities affect Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The advisory applies to Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Red Hat has released updated packages to fix these issues. No CVSS scores are provided in the advisory, but the update is rated as Important.

The vulnerabilities fixed include memory safety issues, use-after-free conditions, sandbox escape, privilege escalation, same-origin policy bypass, and JIT miscompilation bugs. These could potentially allow attackers to execute arbitrary code, escalate privileges, bypass security policies, or escape sandbox restrictions within the affected Firefox and Thunderbird versions. The advisory rates the security impact as Important, indicating significant risk if unpatched.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants that address these vulnerabilities. Users should apply the available security update (firefox-140.6.0-1.el9_4 and related packages) as described in the Red Hat advisory RHSA-2026:0016 and the update instructions at https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. Patch status is confirmed as fixed in the updated packages.