This Red Hat security advisory addresses a set of 13 vulnerabilities in Mozilla Firefox, including CVE-2025-14327 and multiple CVE-2026 series issues. The vulnerabilities cover a range of security flaws such as spoofing in the Downloads Panel and DOM components, use-after-free bugs in JavaScript and IPC components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components, information disclosure in networking and PDF viewer components, mitigation bypass in DOM security, and clickjacking issues. These vulnerabilities affect Firefox ESR 140.7 and Firefox 147 versions distributed with Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory references fixes for these issues and directs users to apply the updated packages.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and execute use-after-free exploits potentially leading to arbitrary code execution or privilege escalation. The presence of multiple sandbox escape vulnerabilities and memory safety bugs indicates a significant risk to the security boundary of the browser environment. The advisory rates the overall security impact as Important (high severity).

Red Hat has released updated Firefox packages (ESR 140.7 and Firefox 147) that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support should apply these updates promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities described.