This Red Hat security advisory (RHSA-2026:2271) addresses a set of 13 security vulnerabilities in Mozilla Firefox distributed with Red Hat Enterprise Linux 10 and its Extended Update Support versions. The vulnerabilities include CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs fixed in Firefox ESR 140.7 and Firefox 147 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM Security (CVE-2026-0877), spoofing in DOM Copy & Paste and Drag & Drop (CVE-2026-0890), and a clickjacking issue. The advisory provides updated Firefox packages that fix these vulnerabilities.

The vulnerabilities collectively impact the security of Firefox by enabling spoofing, memory corruption (use-after-free), sandbox escapes, information disclosure, mitigation bypass, and clickjacking. These issues could allow attackers to bypass security controls, disclose sensitive information, or execute arbitrary code within the browser sandbox. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages (e.g., firefox ESR 140.7 and Firefox 147) for Red Hat Enterprise Linux 10 and Extended Update Support versions that address these vulnerabilities. Users should apply these official security updates promptly. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.