This advisory covers a set of 13 security vulnerabilities impacting Mozilla Thunderbird and Firefox components as packaged in Red Hat Enterprise Linux 10 and its Extended Update Support releases. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These vulnerabilities were fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. Red Hat has released updated packages for these versions to address the issues.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption leading to potential code execution or crashes, sandbox escapes that could allow attackers to break out of restricted execution environments, information disclosure of sensitive data, mitigation bypasses that weaken security controls, and clickjacking attacks. These impacts can compromise the confidentiality, integrity, and security of the affected Thunderbird mail client and related Firefox components on Red Hat Enterprise Linux 10 systems.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el10_1 and corresponding Firefox ESR updates) for Red Hat Enterprise Linux 10 and its Extended Update Support variants that address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigations are indicated beyond applying the vendor-provided patches.