# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Sandbox escape due to incorrect boundary conditions in the Internationalization component](https://agentprime.io/advisories/CVE-2026-100794.md)
  `CVE-2026-100794` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-100793.md)
  `CVE-2026-100793` · CVE record: Mozilla Thunderbird and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100792.md)
  `CVE-2026-100792` · CVE record: Mozilla Thunderbird and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100791.md)
  `CVE-2026-100791` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the XSLT component](https://agentprime.io/advisories/CVE-2026-100790.md)
  `CVE-2026-100790` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-100789.md)
  `CVE-2026-100789` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100788.md)
  `CVE-2026-100788` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the XUL component](https://agentprime.io/advisories/CVE-2026-100787.md)
  `CVE-2026-100787` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-20
- [Sandbox escape due to use-after-free in the Graphics component](https://agentprime.io/advisories/CVE-2026-100786.md)
  `CVE-2026-100786` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100785.md)
  `CVE-2026-100785` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-100784.md)
  `CVE-2026-100784` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Uninitialized memory in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-100783.md)
  `CVE-2026-100783` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Privilege escalation due to incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-100782.md)
  `CVE-2026-100782` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-100781.md)
  `CVE-2026-100781` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100780.md)
  `CVE-2026-100780` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the XSLT component](https://agentprime.io/advisories/CVE-2026-100779.md)
  `CVE-2026-100779` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100778.md)
  `CVE-2026-100778` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-100777.md)
  `CVE-2026-100777` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100776.md)
  `CVE-2026-100776` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the Graphics component](https://agentprime.io/advisories/CVE-2026-100775.md)
  `CVE-2026-100775` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-693
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100774.md)
  `CVE-2026-100774` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Storage: IndexedDB component](https://agentprime.io/advisories/CVE-2026-100773.md)
  `CVE-2026-100773` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100772.md)
  `CVE-2026-100772` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Undefined behavior in the DOM: Streams component](https://agentprime.io/advisories/CVE-2026-100771.md)
  `CVE-2026-100771` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-758
- [Sandbox escape due to use-after-free in the DOM: Content Processes component](https://agentprime.io/advisories/CVE-2026-100770.md)
  `CVE-2026-100770` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100769.md)
  `CVE-2026-100769` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-100768.md)
  `CVE-2026-100768` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use-after-free in the Networking: Cache component](https://agentprime.io/advisories/CVE-2026-100767.md)
  `CVE-2026-100767` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Information disclosure in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-100766.md)
  `CVE-2026-100766` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100765.md)
  `CVE-2026-100765` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-100764.md)
  `CVE-2026-100764` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-100763.md)
  `CVE-2026-100763` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Content Processes component](https://agentprime.io/advisories/CVE-2026-100762.md)
  `CVE-2026-100762` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Privilege escalation due to use-after-free in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-100761.md)
  `CVE-2026-100761` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-100760.md)
  `CVE-2026-100760` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-693
- [Uninitialized memory in the Storage: Quota Manager component](https://agentprime.io/advisories/CVE-2026-100759.md)
  `CVE-2026-100759` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-100758.md)
  `CVE-2026-100758` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Use-after-free in the Widget component](https://agentprime.io/advisories/CVE-2026-100757.md)
  `CVE-2026-100757` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-100756.md)
  `CVE-2026-100756` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in IMAP response parser](https://agentprime.io/advisories/CVE-2026-92240.md)
  `CVE-2026-92240` · CVE record: Mozilla Thunderbird · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Buffer overrun in IMAP](https://agentprime.io/advisories/CVE-2026-92239.md)
  `CVE-2026-92239` · CVE record: Mozilla Thunderbird · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Ambiguous parsing of mail headers](https://agentprime.io/advisories/CVE-2026-92238.md)
  `CVE-2026-92238` · CVE record: Mozilla Thunderbird · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling
- [Mitigation bypass in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-92079.md)
  `CVE-2026-92079` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [Denial-of-service in the Security component](https://agentprime.io/advisories/CVE-2026-92078.md)
  `CVE-2026-92078` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Denial-of-service in the SVG component](https://agentprime.io/advisories/CVE-2026-92077.md)
  `CVE-2026-92077` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Incorrect boundary conditions in the Networking component](https://agentprime.io/advisories/CVE-2026-92076.md)
  `CVE-2026-92076` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Mitigation bypass in the Networking component](https://agentprime.io/advisories/CVE-2026-92075.md)
  `CVE-2026-92075` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [Mitigation bypass in the Popup Blocker component](https://agentprime.io/advisories/CVE-2026-92074.md)
  `CVE-2026-92074` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [Privilege escalation in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-92073.md)
  `CVE-2026-92073` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Incorrect boundary conditions in the Safe Browsing component](https://agentprime.io/advisories/CVE-2026-92072.md)
  `CVE-2026-92072` · CVE record: Mozilla Firefox and 1 more · CVSS 8.0 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-92071.md)
  `CVE-2026-92071` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Information disclosure in the Networking component](https://agentprime.io/advisories/CVE-2026-92070.md)
  `CVE-2026-92070` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure
- [Spoofing issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-92069.md)
  `CVE-2026-92069` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-451
- [Site isolation issue in the Reader Mode component](https://agentprime.io/advisories/CVE-2026-92068.md)
  `CVE-2026-92068` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-346
- [Use-after-free in the Widget: Gtk component](https://agentprime.io/advisories/CVE-2026-92067.md)
  `CVE-2026-92067` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-92066.md)
  `CVE-2026-92066` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-92065.md)
  `CVE-2026-92065` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-92064.md)
  `CVE-2026-92064` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Denial-of-service in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-92063.md)
  `CVE-2026-92063` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Privilege escalation in the Session Restore component](https://agentprime.io/advisories/CVE-2026-92062.md)
  `CVE-2026-92062` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTA5LTE1VDEyOjM0OjIzLjg3NTAwMFoiLCJDVkUtMjAyNi05MjA2MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA5LTI5VDEyOjM2OjE1LjExMDAwMFoiLCJDVkUtMjAyNi05Njg2OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA5LTI5VDEyOjM2OjE1LjExMDAwMFoiLCJDVkUtMjAyNi05Njg2OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.