This Red Hat security advisory covers a set of 13 vulnerabilities in Mozilla Firefox, including CVE-2025-14327 and multiple CVEs from 2026, affecting components like Downloads Panel, JavaScript garbage collection, sandbox boundaries in graphics components, IPC, networking, DOM security, and PDF viewer. The vulnerabilities include spoofing, use-after-free, memory safety bugs, sandbox escapes, information disclosure, mitigation bypass, and clickjacking. These issues are fixed in Firefox ESR 140.7 and Firefox 147 packages provided for Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory references fixes for these vulnerabilities and provides updated packages for affected architectures.

The vulnerabilities could allow attackers to perform spoofing, cause use-after-free conditions potentially leading to crashes or code execution, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts affect the security and integrity of the Firefox browser and potentially the underlying system if exploited. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support that address all listed vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.