Red Hat Product Security released an advisory (RHSA-2025:8341) for Mozilla Firefox and Thunderbird on Red Hat Enterprise Linux 10, addressing seven CVEs (CVE-2025-5263, CVE-2025-5264, CVE-2025-5266, CVE-2025-5267, CVE-2025-5268, CVE-2025-5269, CVE-2025-5283). The vulnerabilities include a clickjacking flaw potentially exposing saved payment card details, a local code execution risk in the 'Copy as cURL' feature, multiple memory safety bugs, leakage of cross-origin resource status via script element events, and incorrect isolation of error handling for script execution from web content. The advisory rates the update as important and provides updated Firefox packages for Red Hat Enterprise Linux 10 and its Extended Update Support variants. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

Successful exploitation of these vulnerabilities could lead to leakage of sensitive user data such as saved payment card details, potential local code execution on affected systems, and information leakage across origins. Memory safety bugs may also lead to application crashes or undefined behavior. These issues collectively pose a high security risk to users of affected Firefox and Thunderbird versions on Red Hat Enterprise Linux 10.

Red Hat has released updated Firefox packages addressing these vulnerabilities for Red Hat Enterprise Linux 10 and its Extended Update Support versions. Users should apply the security update as described in the Red Hat advisory RHSA-2025:8341 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as available via these updates.