Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-12298 CVE record

CVSS 5.4 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12297 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-653
Not analysed yet 16 Jun 2026
CVE-2026-12296 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-403
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12295 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12294 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12293 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12292 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Web Audio component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12291 CVE record

CVSS 8.8 High

Use-after-free in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12290 CVE record

CVSS 8.1 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-823
Not analysed yet 16 Jun 2026
CVE-2026-12289 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 16 Jun 2026
CVE-2026-8975 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8974 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8973 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Thunderbird 151
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8972 CVE record

CVSS 8.8 High

Privilege escalation in the WebRTC: Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 19 May 2026
CVE-2026-8971 CVE record

CVSS 6.5 Medium

Same-origin policy bypass in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 19 May 2026
CVE-2026-8970 CVE record

CVSS 8.8 High

Privilege escalation in the Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 19 May 2026
CVE-2026-8969 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 19 May 2026
CVE-2026-8968 CVE record

CVSS 7.5 High

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 19 May 2026
CVE-2026-8967 CVE record

CVSS 7.5 High

Information disclosure in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 19 May 2026
CVE-2026-8966 CVE record

CVSS 7.5 High

Information disclosure in the IP Protection component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 19 May 2026
CVE-2026-8965 CVE record

CVSS 7.5 High

Information disclosure in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 19 May 2026
CVE-2026-8964 CVE record

CVSS 7.5 High

Spoofing issue in the Popup Blocker component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 19 May 2026
CVE-2026-8963 CVE record

CVSS 7.5 High

Spoofing issue in the Web Speech component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-8962 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 19 May 2026
CVE-2026-8961 CVE record

CVSS 6.5 Medium

Spoofing issue in the Form Autofill component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-8960 CVE record

CVSS 7.5 High

Spoofing issue in WebExtensions
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-8959 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-20
Not analysed yet 19 May 2026
CVE-2026-8958 CVE record

CVSS 8.6 High

Information disclosure, sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-693
Not analysed yet 19 May 2026
CVE-2026-8957 CVE record

CVSS 8.8 High

Privilege escalation in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 19 May 2026
CVE-2026-8956 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8955 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 19 May 2026
CVE-2026-8954 CVE record

CVSS 7.5 High

Incorrect boundary conditions, integer overflow in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8953 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8952 CVE record

CVSS 8.8 High

Privilege escalation in the Application Update component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 19 May 2026
CVE-2026-8950 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Same-origin policy bypass in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 19 May 2026
CVE-2026-8949 CVE record

CVSS 7.5 High

Integer overflow in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8948 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- CWE-942
Not analysed yet 19 May 2026
CVE-2026-8947 CVE record

CVSS 7.3 High

Use-after-free in the DOM: Bindings (WebIDL) component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8946 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 May 2026
CVE-2026-8401 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
- CWE-693
Not analysed yet 12 May 2026
CVE-2026-8391 CVE record

CVSS 5.3 Medium

Other issue in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-8388 CVE record

CVSS 6.5 Medium

Incorrect boundary conditions in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-8094 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 7 May 2026
CVE-2026-8093 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Thunderbird 150.0.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 May 2026
CVE-2026-8092 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 May 2026
CVE-2026-8091 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-754
Not analysed yet 7 May 2026
CVE-2026-8090 CVE record

CVSS 7.3 High

Use-after-free in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 May 2026
CVE-2026-7321 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 28 Apr 2026
CVE-2026-7324 CVE record

CVSS 7.3 High

Memory safety bugs fixed in Thunderbird 150.0.1
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 28 Apr 2026
CVE-2026-7323 CVE record

CVSS 7.3 High

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 28 Apr 2026
CVE-2026-7322 CVE record

CVSS 7.3 High

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 28 Apr 2026
CVE-2026-7320 CVE record

CVSS 7.5 High

Information disclosure due to incorrect boundary conditions in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 28 Apr 2026
CVE-2026-6786 CVE record

CVSS 7.5 High

Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6785 CVE record

CVSS 7.5 High

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6784 CVE record

CVSS 7.5 High

Memory safety bugs fixed in Firefox 150 and Thunderbird 150
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6783 CVE record

CVSS 5.3 Medium

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Apr 2026
CVE-2026-6782 CVE record

CVSS 7.5 High

Information disclosure in the IP Protection component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Apr 2026
CVE-2026-6781 CVE record

CVSS 7.5 High

Denial-of-service in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 21 Apr 2026
CVE-2026-6780 CVE record

CVSS 7.5 High

Denial-of-service in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 21 Apr 2026
CVE-2026-6779 CVE record

CVSS 5.3 Medium

Other issue in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- Memory corruption
Not analysed yet 21 Apr 2026