This Red Hat security advisory (RHSA-2026:2220) addresses 13 distinct vulnerabilities impacting Mozilla Thunderbird and Firefox components packaged with Red Hat Enterprise Linux 8. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure (CVE-2026-0883, CVE-2026-0887), mitigation bypass (CVE-2026-0877), and clickjacking (CVE-2026-0887). These issues affect Thunderbird ESR 140.7, Thunderbird 147, Firefox ESR 140.7, and Firefox 147. The advisory provides updated packages for Red Hat Enterprise Linux 8 on multiple architectures. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities collectively could allow an attacker to perform spoofing, bypass security mitigations, cause use-after-free memory corruption, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts may lead to unauthorized code execution, privilege escalation, or information leakage within affected Thunderbird and Firefox components. The severity is rated as high by Red Hat Product Security.

An official security update is available from Red Hat for Thunderbird and Firefox packages in Red Hat Enterprise Linux 8. Users should apply the update to Thunderbird ESR 140.7 (and related Firefox ESR versions) as provided in advisory RHSA-2026:2220. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.