Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-16377 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16376 CVE record

CVSS 7.5 High

Denial-of-service in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 21 Jul 2026
CVE-2026-16375 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16374 CVE record

CVSS 7.5 High

Information disclosure in the Framework component in DevTools
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16372 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16371 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16370 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16357 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16356 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16355 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16369 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16368 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16367 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape due to invalid pointer in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16354 CVE record

CVSS 7.5 High

Information disclosure in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16353 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer in the DOM: Bindings (WebIDL) component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16366 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16365 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-16364 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16363 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-682
Not analysed yet 21 Jul 2026
CVE-2026-16352 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16351 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16362 CVE record

CVSS 8.8 High

Use-after-free in the WebRTC: Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16350 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: cubeb component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16349 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-15719 CVE record

CVSS 5.4 Medium

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 14 Jul 2026
CVE-2026-15718 CVE record

CVSS 4.3 Medium

Invalid pointer in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Jul 2026
CVE-2026-57963 CVE record

CVSS 6.5 Medium

Chat UI manipulation by injection
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 1 Jul 2026
CVE-2026-57962 CVE record

CVSS 5.3 Medium

Denial-of-service via malicious LDAP address-book server
- Mozilla Thunderbird
- Denial of service
Not analysed yet 1 Jul 2026
CVE-2026-12330 CVE record

CVSS 5.4 Medium

Incorrect boundary conditions in the Internationalization component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12329 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird ESR 140.12
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12328 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12327 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12326 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 152 and Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12325 CVE record

CVSS 6.5 Medium

Denial-of-service in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 16 Jun 2026
CVE-2026-12324 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 16 Jun 2026
CVE-2026-12323 CVE record

CVSS 5.4 Medium

Spoofing issue in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 16 Jun 2026
CVE-2026-12322 CVE record

CVSS 5.4 Medium

Clickjacking issue in the Widget: Gtk component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 16 Jun 2026
CVE-2026-12321 CVE record

CVSS 5.4 Medium

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-670
Not analysed yet 16 Jun 2026
CVE-2026-12320 CVE record

CVSS 4.3 Medium

Information disclosure in the Password Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 16 Jun 2026
CVE-2026-12319 CVE record

CVSS 6.5 Medium

Denial-of-service in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 16 Jun 2026
CVE-2026-12318 CVE record

CVSS 7.3 High

Incorrect boundary conditions in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12317 CVE record

CVSS 7.5 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12316 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12315 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12314 CVE record

CVSS 7.5 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12313 CVE record

CVSS 4.7 Medium

Information disclosure, sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 16 Jun 2026
CVE-2026-12312 CVE record

CVSS 7.5 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12311 CVE record

CVSS 4.7 Medium

Information disclosure, sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-688
Not analysed yet 16 Jun 2026
CVE-2026-12310 CVE record

CVSS 7.5 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12309 CVE record

CVSS 6.5 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12308 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12307 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12306 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12305 CVE record

CVSS 7.5 High

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12304 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 16 Jun 2026
CVE-2026-12303 CVE record

CVSS 4.3 Medium

Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12302 CVE record

CVSS 6.5 Medium

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12301 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12300 CVE record

CVSS 5.3 Medium

Memory safety bug fixed in Thunderbird 152
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Jun 2026
CVE-2026-12299 CVE record

CVSS 5.4 Medium

JIT miscompilation in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-733
Not analysed yet 16 Jun 2026