RHSA-2025:8756

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10.

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used.

It was possible to craft an email that showed a tracking link as an attachment.

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks.