This Red Hat security advisory (RHSA-2026:2069) addresses 13 distinct vulnerabilities in Mozilla Firefox and Thunderbird components distributed with Red Hat Enterprise Linux 8.8. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking (CVE-2026-0887). Red Hat has released updated Firefox ESR 140.7 and Firefox 147 packages to remediate these issues.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause use-after-free memory corruption, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts can compromise browser security, potentially leading to unauthorized code execution or data exposure. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated Firefox ESR 140.7 and Firefox 147 packages for Red Hat Enterprise Linux 8.8 that address all listed vulnerabilities. Users should apply these official security updates promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.