RHSA-2026:2074HighCVSS 7.5

Red Hat Security Advisory: firefox security update

Published
February 5, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (13)

CVE-2025-14327 →CVE-2026-0877 →CVE-2026-0878 →CVE-2026-0879 →CVE-2026-0880 →CVE-2026-0882 →CVE-2026-0883 →CVE-2026-0887 →CVE-2026-0884 →CVE-2026-0885 →CVE-2026-0886 →CVE-2026-0890 →CVE-2026-0891 →

📋 Description

CVE-2025-14327 — firefox: Spoofing issue in the Downloads Panel component CVE-2026-0877 — firefox: thunderbird: Mitigation bypass in the DOM: Security component CVE-2026-0878 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component CVE-2026-0879 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-0880 — firefox: thunderbird: Sandbox escape due to integer overflow in the Graphics component CVE-2026-0882 — firefox: thunderbird: Use-after-free in the IPC component CVE-2026-0883 — firefox: thunderbird: Information disclosure in the Networking component CVE-2026-0884 — firefox: thunderbird: Use-after-free in the JavaScript Engine component CVE-2026-0885 — firefox: thunderbird: Use-after-free in the JavaScript: GC component CVE-2026-0886 — firefox: thunderbird: Incorrect boundary conditions in the Graphics component CVE-2026-0887 — firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component CVE-2026-0890 — firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component CVE-2026-0891 — firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

🎯 Affected products5

  • Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • firefox-0:140.7.0-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • firefox-0:140.7.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • firefox-debuginfo-0:140.7.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • firefox-debugsource-0:140.7.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users should upgrade to a version containing the upstream fix (Firefox 147, Firefox ESR 140.7, or Firefox ESR 115.32), or to the corresponding updated Red Hat Firefox and Thunderbird packages released via Red Hat errata. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a version that contains the upstream fix (Firefox 147 or Firefox ESR 140.7, and Thunderbird 147 or Thunderbird 140.7, or later) addresses this issue.

🔗 References (16)