This Red Hat security advisory (RHSA-2026:0924) addresses a set of 13 vulnerabilities impacting Mozilla Thunderbird and Firefox components packaged for Red Hat Enterprise Linux 9. The vulnerabilities include a spoofing issue in the Downloads Panel (CVE-2025-14327), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and spoofing and clickjacking issues in DOM components (CVE-2026-0890). These issues are fixed in Thunderbird ESR 140.7 and Thunderbird 147 packages. The advisory provides updated packages for various Red Hat Enterprise Linux 9 architectures and variants.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, cause memory corruption through use-after-free bugs, escape sandbox restrictions, disclose sensitive information, and perform clickjacking attacks. These impacts could compromise the confidentiality, integrity, and security boundaries of the affected Thunderbird and Firefox components. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Thunderbird packages (ESR 140.7) for Red Hat Enterprise Linux 9 that address all listed vulnerabilities. Users and administrators should apply these security updates promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are indicated or required beyond applying the official update.