Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-74967 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74965 CVE record

CVSS 8.8 High

Privilege escalation in the Shell Integration component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74964 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74963 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74962 CVE record

CVSS 8.1 High

Site isolation issue in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74960 CVE record

CVSS 8.1 High

Site isolation issue in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74959 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Storage: Cache API component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74957 CVE record

CVSS 8.1 High

Mitigation bypass in the Safe Browsing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74953 CVE record

CVSS 8.8 High

Privilege escalation in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74949 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74948 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74946 CVE record

CVSS 8.8 High

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74945 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74944 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74943 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74942 CVE record

CVSS 8.8 High

Privilege escalation in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74941 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74940 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74939 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74936 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74935 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74934 CVE record

CVSS 7.5 High

Site isolation issue in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-14899 CVE record

CVSS 7.5 High

Off-by-one out of bounds read in MIME header parser for forwarding
- Mozilla Thunderbird
- CWE-193
Not analysed yet 22 Jul 2026
CVE-2026-16361 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16360 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16412 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16411 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16410 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16409 CVE record

CVSS 7.5 High

Invalid pointer in the Security: PSM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16408 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16407 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16406 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16405 CVE record

CVSS 7.5 High

Information disclosure in the Networking: WebSockets component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16403 CVE record

CVSS 6.5 Medium

Spoofing issue in the Address Bar component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 21 Jul 2026
CVE-2026-16402 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16401 CVE record

CVSS 8.8 High

Privilege escalation in the Data Loss Prevention component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16400 CVE record

CVSS 7.5 High

Information disclosure in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16399 CVE record

CVSS 7.5 High

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16398 CVE record

CVSS 7.5 High

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16396 CVE record

CVSS 8.8 High

Privilege escalation in WebExtensions
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16395 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16394 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16359 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16393 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16392 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-670
Not analysed yet 21 Jul 2026
CVE-2026-16391 CVE record

CVSS 7.5 High

Information disclosure in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16390 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16389 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions, integer overflow in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16388 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16387 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-16386 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16385 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16384 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16383 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16382 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16381 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16380 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16358 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16379 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16378 CVE record

CVSS 7.5 High

Other issue in the DOM: Copy & Paste and Drag & Drop component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 21 Jul 2026