Red Hat Product Security released an advisory (RHSA-2026:1471) for Mozilla Thunderbird and Firefox addressing 13 security vulnerabilities, including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. The issues include spoofing in the Downloads Panel and DOM components, use-after-free bugs in JavaScript and IPC components, memory safety fixes, sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components, information disclosure in networking and PDF viewer components, mitigation bypass in DOM security, and clickjacking vulnerabilities. These flaws affect Thunderbird ESR 140.7, Firefox ESR 140.7, Thunderbird 147, and Firefox 147. The advisory applies to Red Hat Enterprise Linux Server AUS 8.2 x86_64 and provides updated packages to fix these vulnerabilities.

The vulnerabilities collectively pose risks including spoofing, memory corruption (use-after-free), sandbox escape, information disclosure, mitigation bypass, and clickjacking. These could potentially allow attackers to bypass security controls, execute arbitrary code, or disclose sensitive information within affected Thunderbird and Firefox versions. Red Hat rates the overall security impact as Important, indicating significant but not critical risk. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:1471 and the referenced article https://access.redhat.com/articles/11258. This update includes fixes for all listed CVEs. No additional mitigation steps are indicated beyond applying the official update.