Red Hat Product Security released an advisory (RHSA-2026:2069) for Mozilla Firefox addressing 13 vulnerabilities including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The issues include spoofing in the Downloads Panel and DOM components, use-after-free bugs in JavaScript and IPC components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components, information disclosure in Networking and PDF Viewer components, mitigation bypass in DOM security, and clickjacking vulnerabilities. These vulnerabilities affect Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147 as distributed in Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. Red Hat has released updated packages to fix these vulnerabilities. The advisory references detailed CVE pages for further information and provides instructions for applying the update.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption (use-after-free), sandbox escapes, information disclosure, mitigation bypass, and clickjacking. These could allow attackers to bypass security controls, execute arbitrary code, or disclose sensitive information. The update addresses these issues to prevent potential exploitation. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated Firefox packages (version 140.7.0-1.el8_8 and related) for Red Hat Enterprise Linux 8.8 and associated update services. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the security update. No additional mitigation actions are indicated beyond applying the provided patches.