Red Hat Product Security released an important security advisory (RHSA-2026:0127) addressing multiple vulnerabilities in Mozilla Firefox and Thunderbird. The vulnerabilities include a use-after-free in the WebRTC signaling component (CVE-2025-14321), several JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), a sandbox escape due to incorrect boundary conditions in the CanvasWebGL graphics component (CVE-2025-14322), privilege escalations in the Netmonitor and DOM notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), a same-origin policy bypass in request handling (CVE-2025-14331), and memory safety bugs (CVE-2025-14333). These issues are fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146 packages for Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures.

The vulnerabilities collectively impact the security of Firefox and Thunderbird by enabling potential memory corruption, sandbox escapes, privilege escalations, and bypasses of security policies such as same-origin policy. These could allow attackers to execute arbitrary code, escalate privileges, or bypass security restrictions within the affected applications. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated Firefox and Thunderbird packages (e.g., firefox ESR 140.6) for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in these updated packages.