This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-10527 (use-after-free leading to sandbox escape in Graphics Canvas2D), CVE-2025-10528 (undefined behavior and invalid pointer causing sandbox escape in Graphics Canvas2D), CVE-2025-10529 (same-origin policy bypass in Layout component), CVE-2025-10532 (incorrect boundary conditions in JavaScript garbage collector), CVE-2025-10533 (integer overflow in SVG component), CVE-2025-10536 (information disclosure in Networking Cache), and CVE-2025-10537 (memory safety bugs). These vulnerabilities affect Firefox ESR 140.0 through versions before 140.3 and Firefox 143 before 143.1, as packaged for Red Hat Enterprise Linux 9.2. The advisory confirms that patches are available to remediate these issues.

The vulnerabilities include sandbox escapes, which could allow an attacker to break out of the browser's sandbox environment, potentially leading to code execution outside the sandbox. The same-origin policy bypass could allow unauthorized access to restricted web content. Memory safety bugs, use-after-free, integer overflow, and information disclosure issues could lead to crashes, data leaks, or other unintended behavior. The overall security impact is rated as Important by Red Hat, indicating a high risk if unpatched.

A security update is available from Red Hat that addresses all listed vulnerabilities. Users should apply the Firefox update to ESR 140.3 or later and Firefox 143.1 or later as provided by Red Hat Enterprise Linux 9.2 update services. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.