This Red Hat security advisory addresses a set of 13 vulnerabilities impacting Mozilla Thunderbird and Firefox components bundled with Red Hat Enterprise Linux 9.6 Extended Update Support. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC and engine components (CVE-2026-0885, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), mitigation bypass in DOM security (CVE-2026-0877), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), and use-after-free in IPC component (CVE-2026-0882). These issues are fixed in Thunderbird ESR 140.7 and Thunderbird 147 versions as provided by Red Hat packages.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause memory corruption leading to potential code execution, escape sandbox restrictions, disclose sensitive information, and perform clickjacking attacks. The presence of use-after-free and sandbox escape vulnerabilities indicates potential for serious security breaches if exploited. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these official security updates promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated beyond applying the provided patches.