# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Undefined behavior in the WebRTC: Signaling component](https://agentprime.io/advisories/CVE-2026-4705.md)
  `CVE-2026-4705` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-758
- [Denial-of-service in the WebRTC: Signaling component](https://agentprime.io/advisories/CVE-2026-4704.md)
  `CVE-2026-4704` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Undefined behavior in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-4724.md)
  `CVE-2026-4724` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-758
- [Use-after-free in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-4723.md)
  `CVE-2026-4723` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-4702.md)
  `CVE-2026-4702` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Privilege escalation in the IPC component](https://agentprime.io/advisories/CVE-2026-4722.md)
  `CVE-2026-4722` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Mar 2026
- [Use-after-free in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-4701.md)
  `CVE-2026-4701` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Mitigation bypass in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-4700.md)
  `CVE-2026-4700` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Authentication bypass, HTTP request smuggling
- [Incorrect boundary conditions in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-4699.md)
  `CVE-2026-4699` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-4698.md)
  `CVE-2026-4698` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-733
- [Incorrect boundary conditions in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-4697.md)
  `CVE-2026-4697` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [Use-after-free in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-4696.md)
  `CVE-2026-4696` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-4695.md)
  `CVE-2026-4695` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [Incorrect boundary conditions, integer overflow in the Graphics component](https://agentprime.io/advisories/CVE-2026-4694.md)
  `CVE-2026-4694` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-4693.md)
  `CVE-2026-4693` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754, CWE-823
- [Sandbox escape in the Responsive Design Mode component](https://agentprime.io/advisories/CVE-2026-4692.md)
  `CVE-2026-4692` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-653
- [Use-after-free in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-4691.md)
  `CVE-2026-4691` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component](https://agentprime.io/advisories/CVE-2026-4690.md)
  `CVE-2026-4690` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component](https://agentprime.io/advisories/CVE-2026-4689.md)
  `CVE-2026-4689` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-4688.md)
  `CVE-2026-4688` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Telemetry component](https://agentprime.io/advisories/CVE-2026-4687.md)
  `CVE-2026-4687` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-501
- [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4686.md)
  `CVE-2026-4686` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4685.md)
  `CVE-2026-4685` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754
- [Race condition, use-after-free in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-4684.md)
  `CVE-2026-4684` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Race condition, Memory corruption, CWE-364
- [Memory safety bugs fixed in Firefox 148 and Thunderbird 148](https://agentprime.io/advisories/CVE-2026-2807.md)
  `CVE-2026-2807` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Uninitialized memory in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-2806.md)
  `CVE-2026-2806` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Invalid pointer in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-2805.md)
  `CVE-2026-2805` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-2804.md)
  `CVE-2026-2804` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Information disclosure, mitigation bypass in the Settings UI component](https://agentprime.io/advisories/CVE-2026-2803.md)
  `CVE-2026-2803` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Information disclosure, CWE-693
- [Race condition in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-2802.md)
  `CVE-2026-2802` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Race condition
- [Incorrect boundary conditions in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-2801.md)
  `CVE-2026-2801` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-754
- [Spoofing issue in the WebAuthn component in Firefox for Android](https://agentprime.io/advisories/CVE-2026-2800.md)
  `CVE-2026-2800` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Authentication bypass
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-2799.md)
  `CVE-2026-2799` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-2798.md)
  `CVE-2026-2798` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-2797.md)
  `CVE-2026-2797` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-2796.md)
  `CVE-2026-2796` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-2795.md)
  `CVE-2026-2795` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148](https://agentprime.io/advisories/CVE-2026-2793.md)
  `CVE-2026-2793` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148](https://agentprime.io/advisories/CVE-2026-2792.md)
  `CVE-2026-2792` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Mitigation bypass in the Networking: Cache component](https://agentprime.io/advisories/CVE-2026-2791.md)
  `CVE-2026-2791` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Authentication bypass
- [Same-origin policy bypass in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-2790.md)
  `CVE-2026-2790` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-346
- [Use-after-free in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-2789.md)
  `CVE-2026-2789` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2026-2788.md)
  `CVE-2026-2788` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Window and Location component](https://agentprime.io/advisories/CVE-2026-2787.md)
  `CVE-2026-2787` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-2786.md)
  `CVE-2026-2786` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-2785.md)
  `CVE-2026-2785` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-2784.md)
  `CVE-2026-2784` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Authentication bypass
- [Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-2783.md)
  `CVE-2026-2783` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Information disclosure
- [Privilege escalation in the Netmonitor component](https://agentprime.io/advisories/CVE-2026-2782.md)
  `CVE-2026-2782` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Privilege escalation
- [Integer overflow in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-2781.md)
  `CVE-2026-2781` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Privilege escalation in the Netmonitor component](https://agentprime.io/advisories/CVE-2026-2780.md)
  `CVE-2026-2780` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Privilege escalation
- [Incorrect boundary conditions in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-2779.md)
  `CVE-2026-2779` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-2778.md)
  `CVE-2026-2778` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Privilege escalation in the Messaging System component](https://agentprime.io/advisories/CVE-2026-2777.md)
  `CVE-2026-2777` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Privilege escalation
- [Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software](https://agentprime.io/advisories/CVE-2026-2776.md)
  `CVE-2026-2776` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: HTML Parser component](https://agentprime.io/advisories/CVE-2026-2775.md)
  `CVE-2026-2775` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Authentication bypass
- [Integer overflow in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-2774.md)
  `CVE-2026-2774` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Web Audio component](https://agentprime.io/advisories/CVE-2026-2773.md)
  `CVE-2026-2773` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Use-after-free in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-2772.md)
  `CVE-2026-2772` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption
- [Undefined behavior in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-2771.md)
  `CVE-2026-2771` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTAyLTI0VDEzOjMzOjA4LjUzODAwMFoiLCJDVkUtMjAyNi0yNzcxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTAzLTI0VDEyOjMwOjMzLjI2MzAwMFoiLCJDVkUtMjAyNi00NzA2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTAzLTI0VDEyOjMwOjMzLjI2MzAwMFoiLCJDVkUtMjAyNi00NzA2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.