Red Hat Product Security released an important security advisory (RHSA-2026:2073) addressing 13 vulnerabilities in Mozilla Firefox and Thunderbird components. The issues include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM Security (CVE-2026-0877), and clickjacking issues. These vulnerabilities affect Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 as packaged in Red Hat Enterprise Linux 8.4. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively impact the security of Firefox and Thunderbird users by enabling potential spoofing, memory corruption (use-after-free), sandbox escapes, information disclosure, mitigation bypass, and clickjacking attacks. These could allow attackers to bypass security controls, execute arbitrary code, disclose sensitive information, or deceive users. The advisory rates the overall impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 8.4 (including AUS and EUS extensions) that address these vulnerabilities. Users should apply the security update (firefox-140.7.0-1.el8_4) as soon as possible following Red Hat's update instructions at https://access.redhat.com/articles/11258. This update fixes all listed CVEs and mitigates the associated risks. No additional mitigation actions are specified or required beyond applying the official update.