This Red Hat security advisory (RHSA-2025:9075) addresses several vulnerabilities in Firefox and Thunderbird, including CVE-2025-5263 through CVE-2025-5269 and CVE-2025-5283. The issues include a clickjacking vulnerability that could lead to leaking saved payment card details (CVE-2025-5267), potential local code execution in the 'Copy as cURL' command (CVE-2025-5264), multiple memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status via script element events (CVE-2025-5266), and incorrect isolation of error handling for script execution from web content (CVE-2025-5263). Red Hat has released an update for Red Hat Enterprise Linux 8.2 to address these vulnerabilities. The advisory references bugzilla entries and provides links for applying the update.

The vulnerabilities collectively could lead to leakage of sensitive information such as saved payment card details, potential local code execution, and memory safety issues that may affect the stability and security of Firefox and Thunderbird. The clickjacking vulnerability could expose user payment data, while the local code execution flaw could allow an attacker to execute code locally. Memory safety bugs and improper error handling isolation increase the risk of crashes or exploitation. These issues pose a high security risk if left unpatched.

Red Hat has issued an official security update for Red Hat Enterprise Linux 8.2 that addresses these vulnerabilities. Users should apply the provided Firefox update (version 128.11.0-1.el8_2) as detailed in the Red Hat advisory RHSA-2025:9075 and the associated article https://access.redhat.com/articles/11258. No alternative mitigations are indicated; applying the update is the recommended remediation.