Red Hat issued a security advisory (RHSA-2026:1413) for Thunderbird on Red Hat Enterprise Linux 9.0 addressing 13 vulnerabilities (CVE-2025-14327, CVE-2026-0877 through CVE-2026-0891). The issues include spoofing in the Downloads Panel and DOM components, use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components, information disclosure in Networking and PDF Viewer components, mitigation bypass in the DOM security component, and clickjacking vulnerabilities. These bugs were fixed in Thunderbird ESR 140.7 and Thunderbird 147 as well as Firefox ESR 140.7 and Firefox 147. The advisory provides updated packages for multiple architectures and directs users to apply the update to remediate these vulnerabilities.

The vulnerabilities collectively could allow attackers to perform spoofing, cause memory corruption via use-after-free bugs, escape sandbox restrictions, disclose sensitive information, bypass security mitigations, and conduct clickjacking attacks. These issues affect core components of Thunderbird and Firefox ESR versions distributed by Red Hat, potentially compromising confidentiality, integrity, and security isolation if exploited. However, no known exploits in the wild have been reported.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described vulnerabilities.