This Red Hat security advisory covers a set of 13 vulnerabilities affecting Mozilla Thunderbird and Firefox components as packaged in Red Hat Enterprise Linux 9.0. The issues include spoofing in the Downloads Panel (CVE-2025-14327), multiple use-after-free vulnerabilities in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and spoofing and clickjacking issues in DOM components (CVE-2026-0890). These vulnerabilities have been fixed in Thunderbird ESR 140.7 and Thunderbird 147 packages provided by Red Hat. The advisory is identified as RHSA-2026:1413 and rated with an overall security impact of Important by Red Hat Product Security.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass mitigations, escape sandbox restrictions, cause use-after-free memory corruption, disclose sensitive information, and conduct clickjacking attacks. These issues affect the security and integrity of the Thunderbird mail client and potentially its underlying Firefox components. The impact severity is assessed as high due to the range of memory safety and sandbox escape issues, although no known exploits in the wild have been reported.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation actions are specified beyond applying the vendor-provided patches.