This advisory covers a set of security fixes for Mozilla Firefox and Thunderbird addressing multiple vulnerabilities: memory safety bugs (CVE-2025-14333), use-after-free in the WebRTC signaling component (CVE-2025-14321), JIT miscompilation in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to incorrect boundary conditions in the Graphics CanvasWebGL component (CVE-2025-14322), privilege escalation in the Netmonitor component (CVE-2025-14328, CVE-2025-14329), same-origin policy bypass in the Request Handling component (CVE-2025-14331), and privilege escalation in the DOM Notifications component (CVE-2025-14323). Red Hat has issued updates for Firefox in RHEL 8.6 to remediate these issues. No CVSS scores are provided in the advisory, but the overall severity is rated as important.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, bypass security policies such as same-origin, or escape sandbox restrictions within the Firefox and Thunderbird applications. These issues affect core components including WebRTC, JavaScript engine, graphics rendering, network monitoring, and DOM notifications, potentially compromising confidentiality, integrity, and availability of affected systems running vulnerable versions.

Red Hat has released security updates for Firefox in Red Hat Enterprise Linux 8.6 (firefox-140.6.0-2.el8_6) that address these vulnerabilities. Users should apply the official Red Hat update as described in the advisory (RHSA-2026:0014) to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.