# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Same-origin policy bypass in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-74967.md)
  `CVE-2026-74967` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Privilege escalation in the Shell Integration component](https://agentprime.io/advisories/CVE-2026-74965.md)
  `CVE-2026-74965` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Integer overflow in the Graphics component](https://agentprime.io/advisories/CVE-2026-74964.md)
  `CVE-2026-74964` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-74963.md)
  `CVE-2026-74963` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Site isolation issue in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-74962.md)
  `CVE-2026-74962` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Site isolation issue in the WebExtensions component](https://agentprime.io/advisories/CVE-2026-74960.md)
  `CVE-2026-74960` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control, CWE-346
- [Mitigation bypass in the Storage: Cache API component](https://agentprime.io/advisories/CVE-2026-74959.md)
  `CVE-2026-74959` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Mitigation bypass in the Safe Browsing component](https://agentprime.io/advisories/CVE-2026-74957.md)
  `CVE-2026-74957` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Privilege escalation in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-74953.md)
  `CVE-2026-74953` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-74949.md)
  `CVE-2026-74949` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Information disclosure in the Graphics component](https://agentprime.io/advisories/CVE-2026-74948.md)
  `CVE-2026-74948` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-74946.md)
  `CVE-2026-74946` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Information disclosure in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-74945.md)
  `CVE-2026-74945` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-74944.md)
  `CVE-2026-74944` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Use-after-free in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-74943.md)
  `CVE-2026-74943` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Privilege escalation in the Remote Settings Client component](https://agentprime.io/advisories/CVE-2026-74942.md)
  `CVE-2026-74942` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Privilege escalation in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-74941.md)
  `CVE-2026-74941` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Use-after-free in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-74940.md)
  `CVE-2026-74940` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Privilege escalation in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-74939.md)
  `CVE-2026-74939` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-74936.md)
  `CVE-2026-74936` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Privilege escalation in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-74935.md)
  `CVE-2026-74935` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Site isolation issue in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-74934.md)
  `CVE-2026-74934` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure, Broken access control, CWE-346
- [Off-by-one out of bounds read in MIME header parser for forwarding](https://agentprime.io/advisories/CVE-2026-14899.md)
  `CVE-2026-14899` · CVE record: Mozilla Thunderbird · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-193
- [Memory safety bugs fixed in Thunderbird ESR 140.13](https://agentprime.io/advisories/CVE-2026-16361.md)
  `CVE-2026-16361` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153](https://agentprime.io/advisories/CVE-2026-16360.md)
  `CVE-2026-16360` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153](https://agentprime.io/advisories/CVE-2026-16412.md)
  `CVE-2026-16412` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Thunderbird 153](https://agentprime.io/advisories/CVE-2026-16411.md)
  `CVE-2026-16411` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-16410.md)
  `CVE-2026-16410` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Invalid pointer in the Security: PSM component](https://agentprime.io/advisories/CVE-2026-16409.md)
  `CVE-2026-16409` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Integer overflow in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-16408.md)
  `CVE-2026-16408` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-16407.md)
  `CVE-2026-16407` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-693
- [Mitigation bypass in the Networking component](https://agentprime.io/advisories/CVE-2026-16406.md)
  `CVE-2026-16406` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Information disclosure in the Networking: WebSockets component](https://agentprime.io/advisories/CVE-2026-16405.md)
  `CVE-2026-16405` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Spoofing issue in the Address Bar component](https://agentprime.io/advisories/CVE-2026-16403.md)
  `CVE-2026-16403` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-451
- [Integer overflow in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-16402.md)
  `CVE-2026-16402` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Privilege escalation in the Data Loss Prevention component](https://agentprime.io/advisories/CVE-2026-16401.md)
  `CVE-2026-16401` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Information disclosure in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-16400.md)
  `CVE-2026-16400` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16399.md)
  `CVE-2026-16399` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the Graphics component](https://agentprime.io/advisories/CVE-2026-16398.md)
  `CVE-2026-16398` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, CWE-346
- [Privilege escalation in WebExtensions](https://agentprime.io/advisories/CVE-2026-16396.md)
  `CVE-2026-16396` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Integer overflow in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-16395.md)
  `CVE-2026-16395` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-16394.md)
  `CVE-2026-16394` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Incorrect boundary conditions in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2026-16359.md)
  `CVE-2026-16359` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16393.md)
  `CVE-2026-16393` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-16392.md)
  `CVE-2026-16392` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, CWE-670
- [Information disclosure in the Storage: IndexedDB component](https://agentprime.io/advisories/CVE-2026-16391.md)
  `CVE-2026-16391` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Mitigation bypass in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-16390.md)
  `CVE-2026-16390` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Incorrect boundary conditions, integer overflow in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-16389.md)
  `CVE-2026-16389` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Sandbox escape in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-16388.md)
  `CVE-2026-16388` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Site isolation issue in the Networking component](https://agentprime.io/advisories/CVE-2026-16387.md)
  `CVE-2026-16387` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Broken access control, CWE-346
- [Information disclosure due to uninitialized memory in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16386.md)
  `CVE-2026-16386` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Information disclosure due to uninitialized memory in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16385.md)
  `CVE-2026-16385` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Information disclosure due to uninitialized memory in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-16384.md)
  `CVE-2026-16384` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-16383.md)
  `CVE-2026-16383` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Mitigation bypass in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-16382.md)
  `CVE-2026-16382` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Same-origin policy bypass in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-16381.md)
  `CVE-2026-16381` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Mitigation bypass in the Networking component](https://agentprime.io/advisories/CVE-2026-16380.md)
  `CVE-2026-16380` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-693
- [Site isolation issue in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-16358.md)
  `CVE-2026-16358` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Privilege escalation in the DOM: Content Processes component](https://agentprime.io/advisories/CVE-2026-16379.md)
  `CVE-2026-16379` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Privilege escalation
- [Other issue in the DOM: Copy & Paste and Drag & Drop component](https://agentprime.io/advisories/CVE-2026-16378.md)
  `CVE-2026-16378` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-20

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTA3LTIxVDEyOjM3OjUyLjk5MDAwMFoiLCJDVkUtMjAyNi0xNjM3OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA4LTE4VDEyOjIzOjMzLjE1NTAwMFoiLCJDVkUtMjAyNi03NDk2OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA4LTE4VDEyOjIzOjMzLjE1NTAwMFoiLCJDVkUtMjAyNi03NDk2OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.