Red Hat issued a security advisory (RHSA-2025:12360) for Firefox on Red Hat Enterprise Linux 8.8 variants, addressing nine CVEs (CVE-2025-8027 through CVE-2025-8035). The vulnerabilities include a large branch table issue causing truncated instructions, multiple memory safety bugs, incorrect URL stripping in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine stack, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, XSLT documents bypassing CSP, and execution of javascript: URLs on object and embed tags. These flaws affect both Firefox and Thunderbird components. The advisory provides updated Firefox packages to remediate these issues.

The vulnerabilities collectively impact the security and stability of Firefox and Thunderbird by enabling potential memory corruption, bypass of security policies (CSP), and user-assisted code execution. Exploitation could lead to arbitrary code execution or security policy bypasses, increasing the risk of compromise when using affected versions of Firefox or Thunderbird on Red Hat Enterprise Linux 8.8. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.8 and related variants that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2025:12360 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the official update.