# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Sandbox escape due to use-after-free in the Print Preview component](https://agentprime.io/advisories/CVE-2026-117971.md)
  `CVE-2026-117971` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Race condition in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-117970.md)
  `CVE-2026-117970` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Invalid pointer in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-117969.md)
  `CVE-2026-117969` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117968.md)
  `CVE-2026-117968` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-117967.md)
  `CVE-2026-117967` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-693
- [Site isolation issue in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-117966.md)
  `CVE-2026-117966` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346
- [Same-origin policy bypass in the Address Bar component](https://agentprime.io/advisories/CVE-2026-117965.md)
  `CVE-2026-117965` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346
- [Use-after-free in the Panning and Zooming component](https://agentprime.io/advisories/CVE-2026-117964.md)
  `CVE-2026-117964` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-117963.md)
  `CVE-2026-117963` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component](https://agentprime.io/advisories/CVE-2026-117962.md)
  `CVE-2026-117962` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-117961.md)
  `CVE-2026-117961` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117960.md)
  `CVE-2026-117960` · CVE record: Mozilla Firefox and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-451
- [Site isolation issue in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-117959.md)
  `CVE-2026-117959` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Site isolation issue in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-117958.md)
  `CVE-2026-117958` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346
- [Cryptographic issue in the WebRTC: Networking component](https://agentprime.io/advisories/CVE-2026-117957.md)
  `CVE-2026-117957` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-325
- [Invalid pointer in the Nimbus Desktop Client component](https://agentprime.io/advisories/CVE-2026-117956.md)
  `CVE-2026-117956` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-117955.md)
  `CVE-2026-117955` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Layout: Positioned component](https://agentprime.io/advisories/CVE-2026-117954.md)
  `CVE-2026-117954` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117953.md)
  `CVE-2026-117953` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Uninitialized memory in the Networking component](https://agentprime.io/advisories/CVE-2026-117952.md)
  `CVE-2026-117952` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117951.md)
  `CVE-2026-117951` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117950.md)
  `CVE-2026-117950` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117949.md)
  `CVE-2026-117949` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the SVG component](https://agentprime.io/advisories/CVE-2026-117948.md)
  `CVE-2026-117948` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the XML component](https://agentprime.io/advisories/CVE-2026-117947.md)
  `CVE-2026-117947` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-117946.md)
  `CVE-2026-117946` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the XML component](https://agentprime.io/advisories/CVE-2026-117945.md)
  `CVE-2026-117945` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Layout component](https://agentprime.io/advisories/CVE-2026-117944.md)
  `CVE-2026-117944` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117943.md)
  `CVE-2026-117943` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-117942.md)
  `CVE-2026-117942` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: CSS Object Model component](https://agentprime.io/advisories/CVE-2026-117941.md)
  `CVE-2026-117941` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117940.md)
  `CVE-2026-117940` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the XML component](https://agentprime.io/advisories/CVE-2026-117939.md)
  `CVE-2026-117939` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Layout component](https://agentprime.io/advisories/CVE-2026-117938.md)
  `CVE-2026-117938` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-117937.md)
  `CVE-2026-117937` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117936.md)
  `CVE-2026-117936` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Bindings (WebIDL) component](https://agentprime.io/advisories/CVE-2026-117935.md)
  `CVE-2026-117935` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Layout component](https://agentprime.io/advisories/CVE-2026-117934.md)
  `CVE-2026-117934` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Frame poisoning in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117933.md)
  `CVE-2026-117933` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117932.md)
  `CVE-2026-117932` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Events component](https://agentprime.io/advisories/CVE-2026-117931.md)
  `CVE-2026-117931` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Bindings (WebIDL) component](https://agentprime.io/advisories/CVE-2026-117930.md)
  `CVE-2026-117930` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117929.md)
  `CVE-2026-117929` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117928.md)
  `CVE-2026-117928` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346
- [Use-after-free in the SVG component](https://agentprime.io/advisories/CVE-2026-117927.md)
  `CVE-2026-117927` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the SVG component](https://agentprime.io/advisories/CVE-2026-117926.md)
  `CVE-2026-117926` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117925.md)
  `CVE-2026-117925` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the XSLT component](https://agentprime.io/advisories/CVE-2026-117924.md)
  `CVE-2026-117924` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-117923.md)
  `CVE-2026-117923` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Networking: WebSockets component](https://agentprime.io/advisories/CVE-2026-117922.md)
  `CVE-2026-117922` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117921.md)
  `CVE-2026-117921` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: HTML Parser component](https://agentprime.io/advisories/CVE-2026-117920.md)
  `CVE-2026-117920` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-117919.md)
  `CVE-2026-117919` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-117918.md)
  `CVE-2026-117918` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Invalid pointer in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-117917.md)
  `CVE-2026-117917` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the XSLT component](https://agentprime.io/advisories/CVE-2026-117916.md)
  `CVE-2026-117916` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Layout: Block and Inline component](https://agentprime.io/advisories/CVE-2026-117915.md)
  `CVE-2026-117915` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the SVG component](https://agentprime.io/advisories/CVE-2026-117914.md)
  `CVE-2026-117914` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the SVG component](https://agentprime.io/advisories/CVE-2026-117913.md)
  `CVE-2026-117913` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Same-origin policy bypass in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117912.md)
  `CVE-2026-117912` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTEwLTI3VDE0OjA1OjIyLjc3MTAwMFoiLCJDVkUtMjAyNi0xMTc5MTIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTEwLTI3VDE0OjA1OjQ0LjY2MzAwMFoiLCJDVkUtMjAyNi0xMTc5NzIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTEwLTI3VDE0OjA1OjQ0LjY2MzAwMFoiLCJDVkUtMjAyNi0xMTc5NzIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.