This Red Hat security advisory addresses a set of 13 vulnerabilities impacting Mozilla Thunderbird as packaged in Red Hat Enterprise Linux 8.8. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These vulnerabilities are fixed in Thunderbird ESR 140.7 and Thunderbird 147 versions as provided by Red Hat. The advisory is identified as RHSA-2026:1462 and applies to Red Hat Enterprise Linux 8.8 variants including Update Services for SAP Solutions and Telecommunications Update Service.

The vulnerabilities collectively impact the security of Mozilla Thunderbird by enabling potential spoofing, memory corruption, sandbox escape, information disclosure, mitigation bypass, and clickjacking attacks. These could allow attackers to bypass security controls, execute arbitrary code, disclose sensitive information, or manipulate user interface elements to deceive users. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild are reported at this time.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el8_8) for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply these security updates promptly by following Red Hat's update instructions at https://access.redhat.com/articles/11258. The advisory indicates that the fixes are included in these updated packages, and no additional mitigation steps are required beyond applying the official patches.