# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12298.md)
  `CVE-2026-12298` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Networking component](https://agentprime.io/advisories/CVE-2026-12297.md)
  `CVE-2026-12297` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption, CWE-653
- [Sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-12296.md)
  `CVE-2026-12296` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-403, CWE-693
- [Sandbox escape in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-12295.md)
  `CVE-2026-12295` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-653, CWE-693
- [Sandbox escape in the DOM: Workers component](https://agentprime.io/advisories/CVE-2026-12294.md)
  `CVE-2026-12294` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, CWE-693
- [Use-after-free in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-12293.md)
  `CVE-2026-12293` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Web Audio component](https://agentprime.io/advisories/CVE-2026-12292.md)
  `CVE-2026-12292` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Use-after-free in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-12291.md)
  `CVE-2026-12291` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12290.md)
  `CVE-2026-12290` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption, CWE-823
- [Privilege escalation in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-12289.md)
  `CVE-2026-12289` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation
- [Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151](https://agentprime.io/advisories/CVE-2026-8975.md)
  `CVE-2026-8975` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151](https://agentprime.io/advisories/CVE-2026-8974.md)
  `CVE-2026-8974` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird 151](https://agentprime.io/advisories/CVE-2026-8973.md)
  `CVE-2026-8973` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Privilege escalation in the WebRTC: Audio/Video component](https://agentprime.io/advisories/CVE-2026-8972.md)
  `CVE-2026-8972` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Same-origin policy bypass in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-8971.md)
  `CVE-2026-8971` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-346
- [Privilege escalation in the Security component](https://agentprime.io/advisories/CVE-2026-8970.md)
  `CVE-2026-8970` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-8969.md)
  `CVE-2026-8969` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-693
- [Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-8968.md)
  `CVE-2026-8968` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Denial of service
- [Information disclosure in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-8967.md)
  `CVE-2026-8967` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure
- [Information disclosure in the IP Protection component](https://agentprime.io/advisories/CVE-2026-8966.md)
  `CVE-2026-8966` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure
- [Information disclosure in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-8965.md)
  `CVE-2026-8965` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure
- [Spoofing issue in the Popup Blocker component](https://agentprime.io/advisories/CVE-2026-8964.md)
  `CVE-2026-8964` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-451
- [Spoofing issue in the Web Speech component](https://agentprime.io/advisories/CVE-2026-8963.md)
  `CVE-2026-8963` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-8962.md)
  `CVE-2026-8962` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-693
- [Spoofing issue in the Form Autofill component](https://agentprime.io/advisories/CVE-2026-8961.md)
  `CVE-2026-8961` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Spoofing issue in WebExtensions](https://agentprime.io/advisories/CVE-2026-8960.md)
  `CVE-2026-8960` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-8959.md)
  `CVE-2026-8959` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption, CWE-20, CWE-693
- [Information disclosure, sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-8958.md)
  `CVE-2026-8958` · CVE record: Mozilla Firefox and 1 more · CVSS 8.6 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-693
- [Privilege escalation in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-8957.md)
  `CVE-2026-8957` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Integer overflow in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-8956.md)
  `CVE-2026-8956` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Privilege escalation in the DOM: Workers component](https://agentprime.io/advisories/CVE-2026-8955.md)
  `CVE-2026-8955` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Incorrect boundary conditions, integer overflow in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-8954.md)
  `CVE-2026-8954` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-8953.md)
  `CVE-2026-8953` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Privilege escalation in the Application Update component](https://agentprime.io/advisories/CVE-2026-8952.md)
  `CVE-2026-8952` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Same-origin policy bypass in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-8950.md)
  `CVE-2026-8950` · CVE record: Mozilla Firefox and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: CWE-346
- [Integer overflow in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-8949.md)
  `CVE-2026-8949` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-8948.md)
  `CVE-2026-8948` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS), CWE-942
- [Use-after-free in the DOM: Bindings (WebIDL) component](https://agentprime.io/advisories/CVE-2026-8947.md)
  `CVE-2026-8947` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-8946.md)
  `CVE-2026-8946` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption
- [Sandbox escape in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-8401.md)
  `CVE-2026-8401` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-653, CWE-693
- [Other issue in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-8391.md)
  `CVE-2026-8391` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: Cross-site scripting (XSS), Memory corruption, CWE-20, CWE-475
- [Incorrect boundary conditions in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-8388.md)
  `CVE-2026-8388` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: Memory corruption
- [Other issue in the WebRTC component](https://agentprime.io/advisories/CVE-2026-8094.md)
  `CVE-2026-8094` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Code injection
- [Memory safety bugs fixed in Thunderbird 150.0.2](https://agentprime.io/advisories/CVE-2026-8093.md)
  `CVE-2026-8093` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2](https://agentprime.io/advisories/CVE-2026-8092.md)
  `CVE-2026-8092` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-8091.md)
  `CVE-2026-8091` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption, CWE-754
- [Use-after-free in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-8090.md)
  `CVE-2026-8090` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component](https://agentprime.io/advisories/CVE-2026-7321.md)
  `CVE-2026-7321` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird 150.0.1](https://agentprime.io/advisories/CVE-2026-7324.md)
  `CVE-2026-7324` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1](https://agentprime.io/advisories/CVE-2026-7323.md)
  `CVE-2026-7323` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1](https://agentprime.io/advisories/CVE-2026-7322.md)
  `CVE-2026-7322` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [Information disclosure due to incorrect boundary conditions in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-7320.md)
  `CVE-2026-7320` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150](https://agentprime.io/advisories/CVE-2026-6786.md)
  `CVE-2026-6786` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150](https://agentprime.io/advisories/CVE-2026-6785.md)
  `CVE-2026-6785` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox 150 and Thunderbird 150](https://agentprime.io/advisories/CVE-2026-6784.md)
  `CVE-2026-6784` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-6783.md)
  `CVE-2026-6783` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Information disclosure in the IP Protection component](https://agentprime.io/advisories/CVE-2026-6782.md)
  `CVE-2026-6782` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure
- [Denial-of-service in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-6781.md)
  `CVE-2026-6781` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Denial of service
- [Denial-of-service in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-6780.md)
  `CVE-2026-6780` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Denial of service
- [Other issue in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-6779.md)
  `CVE-2026-6779` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS), Memory corruption, CWE-20

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTA0LTIxVDEyOjQxOjA5Ljc0MDAwMFoiLCJDVkUtMjAyNi02Nzc5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA2LTE2VDExOjUyOjMyLjg4NTAwMFoiLCJDVkUtMjAyNi0xMjI5OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA2LTE2VDExOjUyOjMyLjg4NTAwMFoiLCJDVkUtMjAyNi0xMjI5OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.