This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including memory safety bugs (CVE-2025-14333), use-after-free in the WebRTC signaling component (CVE-2025-14321), JIT miscompilation in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to incorrect boundary conditions in the Graphics CanvasWebGL component (CVE-2025-14322), privilege escalation in the Netmonitor component (CVE-2025-14328, CVE-2025-14329), same-origin policy bypass in the Request Handling component (CVE-2025-14331), and privilege escalation in the DOM Notifications component (CVE-2025-14323). These issues are fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. The advisory is rated as important by Red Hat Product Security and applies to Red Hat Enterprise Linux 7 Extended Lifecycle Support versions on multiple architectures.

The vulnerabilities include memory safety issues, use-after-free conditions, sandbox escape, privilege escalation, and same-origin policy bypass, which could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, or bypass security policies within the affected Firefox and Thunderbird versions. These issues affect the security and integrity of the browser and email client, potentially leading to unauthorized actions or information disclosure.

Red Hat has released updated packages for Firefox ESR 140.6 and Thunderbird ESR 140.6 as part of Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided security update.