This Red Hat security advisory addresses numerous vulnerabilities in Mozilla Firefox and Thunderbird affecting Red Hat Enterprise Linux 9.2. The vulnerabilities include use-after-free bugs, memory safety issues, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, JIT miscompilations, information disclosure, mitigation bypasses, and denial-of-service conditions. These issues span multiple components such as the JavaScript engine, graphics (Canvas2D, WebRender, Text), audio/video (Web Codecs, GMP, Playback), WebRTC signaling, CSS parsing, layout, networking HTTP, telemetry, and others. The advisory references fixes in Firefox ESR 115.34, ESR 140.9, Firefox 149, and Thunderbird 149. Red Hat has released updated packages to remediate these vulnerabilities in their affected distributions.

The vulnerabilities collectively pose a high security risk, including potential arbitrary code execution, privilege escalation, sandbox escapes, information disclosure, and denial-of-service conditions. Exploitation could allow attackers to bypass security boundaries, escalate privileges, or cause application crashes. The wide range of affected components increases the attack surface. However, no known exploits in the wild have been reported at this time.

Red Hat has released security updates for Firefox and Thunderbird in Red Hat Enterprise Linux 9.2, including Firefox ESR 140.9 and Firefox 149. Users should apply these official updates promptly to remediate the vulnerabilities. Refer to the Red Hat advisory RHSA-2026:7841 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance. Patch status is confirmed as fixed in these updated packages.