# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mitigation bypass in the PDF Viewer component](https://agentprime.io/advisories/CVE-2026-16377.md)
  `CVE-2026-16377` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Denial-of-service in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16376.md)
  `CVE-2026-16376` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [Site isolation issue in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-16375.md)
  `CVE-2026-16375` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Information disclosure in the Framework component in DevTools](https://agentprime.io/advisories/CVE-2026-16374.md)
  `CVE-2026-16374` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Privilege escalation in the DOM: Content Processes component](https://agentprime.io/advisories/CVE-2026-16372.md)
  `CVE-2026-16372` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Privilege escalation in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16371.md)
  `CVE-2026-16371` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Mitigation bypass in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-16370.md)
  `CVE-2026-16370` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-16357.md)
  `CVE-2026-16357` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-16356.md)
  `CVE-2026-16356` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, CWE-693
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-16355.md)
  `CVE-2026-16355` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Integer overflow in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-16369.md)
  `CVE-2026-16369` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-16368.md)
  `CVE-2026-16368` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Sandbox escape due to invalid pointer in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-16367.md)
  `CVE-2026-16367` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Information disclosure in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-16354.md)
  `CVE-2026-16354` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Invalid pointer in the DOM: Bindings (WebIDL) component](https://agentprime.io/advisories/CVE-2026-16353.md)
  `CVE-2026-16353` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Privilege escalation in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16366.md)
  `CVE-2026-16366` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Privilege escalation in the DOM: Workers component](https://agentprime.io/advisories/CVE-2026-16365.md)
  `CVE-2026-16365` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-16364.md)
  `CVE-2026-16364` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-16363.md)
  `CVE-2026-16363` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, CWE-682
- [Sandbox escape due to use-after-free in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-16352.md)
  `CVE-2026-16352` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16351.md)
  `CVE-2026-16351` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Use-after-free in the WebRTC: Audio/Video component](https://agentprime.io/advisories/CVE-2026-16362.md)
  `CVE-2026-16362` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: cubeb component](https://agentprime.io/advisories/CVE-2026-16350.md)
  `CVE-2026-16350` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16349.md)
  `CVE-2026-16349` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-15719.md)
  `CVE-2026-15719` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 14 Jul 2026
- [Invalid pointer in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-15718.md)
  `CVE-2026-15718` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Memory corruption
- [Chat UI manipulation by injection](https://agentprime.io/advisories/CVE-2026-57963.md)
  `CVE-2026-57963` · CVE record: Mozilla Thunderbird · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Denial-of-service via malicious LDAP address-book server](https://agentprime.io/advisories/CVE-2026-57962.md)
  `CVE-2026-57962` · CVE record: Mozilla Thunderbird · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service
- [Incorrect boundary conditions in the Internationalization component](https://agentprime.io/advisories/CVE-2026-12330.md)
  `CVE-2026-12330` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird ESR 140.12](https://agentprime.io/advisories/CVE-2026-12329.md)
  `CVE-2026-12329` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12328.md)
  `CVE-2026-12328` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12327.md)
  `CVE-2026-12327` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox 152 and Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12326.md)
  `CVE-2026-12326` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Denial-of-service in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-12325.md)
  `CVE-2026-12325` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [Incorrect boundary conditions in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-12324.md)
  `CVE-2026-12324` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-703
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-12323.md)
  `CVE-2026-12323` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1021
- [Clickjacking issue in the Widget: Gtk component](https://agentprime.io/advisories/CVE-2026-12322.md)
  `CVE-2026-12322` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1021
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-12321.md)
  `CVE-2026-12321` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-670
- [Information disclosure in the Password Manager component](https://agentprime.io/advisories/CVE-2026-12320.md)
  `CVE-2026-12320` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Information disclosure
- [Denial-of-service in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-12319.md)
  `CVE-2026-12319` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Denial of service
- [Incorrect boundary conditions in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-12318.md)
  `CVE-2026-12318` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12317.md)
  `CVE-2026-12317` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-12316.md)
  `CVE-2026-12316` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-693
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-12315.md)
  `CVE-2026-12315` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-693
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12314.md)
  `CVE-2026-12314` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Information disclosure, sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-12313.md)
  `CVE-2026-12313` · CVE record: Mozilla Firefox and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12312.md)
  `CVE-2026-12312` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Information disclosure, sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-12311.md)
  `CVE-2026-12311` · CVE record: Mozilla Firefox and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Information disclosure, CWE-688
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12310.md)
  `CVE-2026-12310` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12309.md)
  `CVE-2026-12309` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12308.md)
  `CVE-2026-12308` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12307.md)
  `CVE-2026-12307` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12306.md)
  `CVE-2026-12306` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12305.md)
  `CVE-2026-12305` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-12304.md)
  `CVE-2026-12304` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-346
- [Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-12303.md)
  `CVE-2026-12303` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-12302.md)
  `CVE-2026-12302` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-693
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12301.md)
  `CVE-2026-12301` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [Memory safety bug fixed in Thunderbird 152](https://agentprime.io/advisories/CVE-2026-12300.md)
  `CVE-2026-12300` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption
- [JIT miscompilation in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-12299.md)
  `CVE-2026-12299` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption, CWE-733

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTA2LTE2VDExOjUyOjMyLjg4NTAwMFoiLCJDVkUtMjAyNi0xMjI5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA3LTIxVDEyOjM3OjUyLjk5MDAwMFoiLCJDVkUtMjAyNi0xNjM3OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA3LTIxVDEyOjM3OjUyLjk5MDAwMFoiLCJDVkUtMjAyNi0xNjM3OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.