This Red Hat security advisory addresses 13 distinct vulnerabilities in Mozilla Firefox, including CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free bugs in JavaScript and IPC components (CVE-2026-0882, CVE-2026-0884, CVE-2026-0885), memory safety bugs fixed in ESR 140.7 and Firefox 147 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM Security (CVE-2026-0877), and spoofing and clickjacking issues in DOM Copy & Paste, Drag & Drop, and PDF Viewer components (CVE-2026-0890). The advisory covers fixes applied in Red Hat Enterprise Linux 10 and its Extended Update Support variants across multiple architectures. The vendor advisory confirms these fixes are available and provides instructions for applying updates.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free memory corruption, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These issues affect core browser components and could undermine the security and privacy guarantees of Firefox users on affected Red Hat Enterprise Linux systems. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated Firefox packages (ESR 140.7 and Firefox 147) that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 10 and its Extended Update Support versions should apply these official security updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation beyond applying the vendor-provided patches is indicated.