Red Hat issued a security advisory (RHSA-2026:2073) for Firefox and Thunderbird packages in Red Hat Enterprise Linux 8.4 addressing 13 distinct vulnerabilities. These include CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free vulnerabilities in JavaScript GC, IPC, and JavaScript engine components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components, information disclosure in Networking and PDF Viewer components, mitigation bypass in DOM security, spoofing in DOM copy & paste and drag & drop, and clickjacking issues. The advisory updates Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 to remediate these issues.

The vulnerabilities collectively impact browser security, potentially allowing attackers to spoof content, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and execute use-after-free memory corruption attacks. These issues could undermine the security guarantees of Firefox and Thunderbird, affecting confidentiality, integrity, and user interface trustworthiness. The advisory rates the overall security impact as Important (high severity).

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 8.4 (AUS and EUS extensions) that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.