# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Calendar invitation attachments could launch local executables](https://agentprime.io/advisories/CVE-2026-84637.md)
  `CVE-2026-84637` · CVE record: Mozilla Thunderbird · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Unrestricted file upload
- [Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2](https://agentprime.io/advisories/CVE-2026-84144.md)
  `CVE-2026-84144` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15](https://agentprime.io/advisories/CVE-2026-84143.md)
  `CVE-2026-84143` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Internally found bugs fixed in Thunderbird 155](https://agentprime.io/advisories/CVE-2026-84142.md)
  `CVE-2026-84142` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Integer overflow in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-84141.md)
  `CVE-2026-84141` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84140.md)
  `CVE-2026-84140` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Clickjacking issue in the DOM: Events component](https://agentprime.io/advisories/CVE-2026-84139.md)
  `CVE-2026-84139` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1021
- [Denial-of-service in the PDF Viewer component](https://agentprime.io/advisories/CVE-2026-84138.md)
  `CVE-2026-84138` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-84137.md)
  `CVE-2026-84137` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-451
- [Other issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84136.md)
  `CVE-2026-84136` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Other issue in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-84134.md)
  `CVE-2026-84134` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Site isolation issue in the DOM: Push Subscriptions component](https://agentprime.io/advisories/CVE-2026-84133.md)
  `CVE-2026-84133` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Information disclosure in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-84132.md)
  `CVE-2026-84132` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Information disclosure in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-84130.md)
  `CVE-2026-84130` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84129.md)
  `CVE-2026-84129` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Privilege escalation in the WebDriver BiDi component](https://agentprime.io/advisories/CVE-2026-84128.md)
  `CVE-2026-84128` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect boundary conditions in the Layout: Grid component](https://agentprime.io/advisories/CVE-2026-84126.md)
  `CVE-2026-84126` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-84125.md)
  `CVE-2026-84125` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-84124.md)
  `CVE-2026-84124` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Privilege escalation due to use-after-free in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-84123.md)
  `CVE-2026-84123` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-84122.md)
  `CVE-2026-84122` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-84118.md)
  `CVE-2026-84118` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15](https://agentprime.io/advisories/CVE-2026-84145.md)
  `CVE-2026-84145` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Privilege escalation due to invalid pointer in the Graphics component](https://agentprime.io/advisories/CVE-2026-84131.md)
  `CVE-2026-84131` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-84121.md)
  `CVE-2026-84121` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-84120.md)
  `CVE-2026-84120` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84119.md)
  `CVE-2026-84119` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Internally found bugs fixed in Firefox 154](https://agentprime.io/advisories/CVE-2026-74989.md)
  `CVE-2026-74989` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154](https://agentprime.io/advisories/CVE-2026-74988.md)
  `CVE-2026-74988` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Site isolation issue in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-74986.md)
  `CVE-2026-74986` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Privilege escalation in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-74985.md)
  `CVE-2026-74985` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Race condition in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-74984.md)
  `CVE-2026-74984` · CVE record: Mozilla Firefox and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Race condition
- [Denial-of-service in the Widget component](https://agentprime.io/advisories/CVE-2026-74982.md)
  `CVE-2026-74982` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service
- [Site isolation issue in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-74981.md)
  `CVE-2026-74981` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Mitigation bypass in the Add-ons Manager component](https://agentprime.io/advisories/CVE-2026-74979.md)
  `CVE-2026-74979` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Clickjacking issue in the Widget component](https://agentprime.io/advisories/CVE-2026-74978.md)
  `CVE-2026-74978` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Integer overflow in the Graphics component](https://agentprime.io/advisories/CVE-2026-74977.md)
  `CVE-2026-74977` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Site isolation issue in the Graphics component](https://agentprime.io/advisories/CVE-2026-74970.md)
  `CVE-2026-74970` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Site isolation issue in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-74968.md)
  `CVE-2026-74968` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Information disclosure in the Form Autofill component](https://agentprime.io/advisories/CVE-2026-74966.md)
  `CVE-2026-74966` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Side-channel in the Web Audio component](https://agentprime.io/advisories/CVE-2026-74961.md)
  `CVE-2026-74961` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Information disclosure in the WebRTC component](https://agentprime.io/advisories/CVE-2026-74958.md)
  `CVE-2026-74958` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Same-origin policy bypass in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-74956.md)
  `CVE-2026-74956` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Privilege escalation in the Request Handling component](https://agentprime.io/advisories/CVE-2026-74955.md)
  `CVE-2026-74955` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Information disclosure due to side-channel in the Storage: Cache API component](https://agentprime.io/advisories/CVE-2026-74954.md)
  `CVE-2026-74954` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Privilege escalation in the Application Update component](https://agentprime.io/advisories/CVE-2026-74952.md)
  `CVE-2026-74952` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Privilege escalation in the Downloads API component](https://agentprime.io/advisories/CVE-2026-74950.md)
  `CVE-2026-74950` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Privilege escalation due to invalid pointer in the Graphics component](https://agentprime.io/advisories/CVE-2026-74947.md)
  `CVE-2026-74947` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Mitigation bypass in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-74938.md)
  `CVE-2026-74938` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Use-after-free in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-74937.md)
  `CVE-2026-74937` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Sandbox escape in the Remote Settings Client component](https://agentprime.io/advisories/CVE-2026-75874.md)
  `CVE-2026-75874` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154](https://agentprime.io/advisories/CVE-2026-74990.md)
  `CVE-2026-74990` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154](https://agentprime.io/advisories/CVE-2026-74987.md)
  `CVE-2026-74987` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Mitigation bypass in the Data Loss Prevention component](https://agentprime.io/advisories/CVE-2026-74983.md)
  `CVE-2026-74983` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-74976.md)
  `CVE-2026-74976` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-74974.md)
  `CVE-2026-74974` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-346
- [Race condition, use-after-free in the Graphics component](https://agentprime.io/advisories/CVE-2026-74973.md)
  `CVE-2026-74973` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Race condition, Memory corruption
- [Information disclosure in the DOM: Push Subscriptions component](https://agentprime.io/advisories/CVE-2026-74972.md)
  `CVE-2026-74972` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Information disclosure in the DOM: UI Events & Focus Handling component](https://agentprime.io/advisories/CVE-2026-74971.md)
  `CVE-2026-74971` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Race condition, use-after-free in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-74969.md)
  `CVE-2026-74969` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTA4LTE4VDEyOjIzOjMzLjE1NTAwMFoiLCJDVkUtMjAyNi03NDk2OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA5LTAxVDIxOjMzOjA2LjI1MTAwMFoiLCJDVkUtMjAyNi04NDYzOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA5LTAxVDIxOjMzOjA2LjI1MTAwMFoiLCJDVkUtMjAyNi04NDYzOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.