Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-84637 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Calendar invitation attachments could launch local executables
- Mozilla Thunderbird
- Unrestricted file upload
Not analysed yet 1 Sept 2026
CVE-2026-84144 CVE record

CVSS 7.5 High

Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84143 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84142 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Thunderbird 155
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84141 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84140 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84139 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Clickjacking issue in the DOM: Events component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 1 Sept 2026
CVE-2026-84138 CVE record

CVSS 7.5 High

Denial-of-service in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 1 Sept 2026
CVE-2026-84137 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Spoofing issue in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 1 Sept 2026
CVE-2026-84136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84134 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84133 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Push Subscriptions component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84132 CVE record

CVSS 7.5 High

Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84130 CVE record

CVSS 7.5 High

Information disclosure in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84129 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84128 CVE record

CVSS 8.8 High

Privilege escalation in the WebDriver BiDi component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 1 Sept 2026
CVE-2026-84126 CVE record

CVSS 4.3 Medium

Incorrect boundary conditions in the Layout: Grid component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84125 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84124 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84123 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84122 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84118 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84145 CVE record

CVSS 7.5 High

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84131 CVE record

CVSS 8.8 High

Privilege escalation due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84121 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84120 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84119 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-74989 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74988 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74986 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Site isolation issue in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74985 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74984 CVE record

CVSS 6.8 Medium

Race condition in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 18 Aug 2026
CVE-2026-74982 CVE record

CVSS 7.5 High

Denial-of-service in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 18 Aug 2026
CVE-2026-74981 CVE record

CVSS 8.1 High

Site isolation issue in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74979 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Add-ons Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-74978 CVE record

CVSS 8.1 High

Clickjacking issue in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74977 CVE record

CVSS 7.5 High

Integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74970 CVE record

CVSS 5.4 Medium

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74968 CVE record

CVSS 5.4 Medium

Site isolation issue in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74966 CVE record

CVSS 7.5 High

Information disclosure in the Form Autofill component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74961 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Side-channel in the Web Audio component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74958 CVE record

CVSS 7.5 High

Information disclosure in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74956 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74955 CVE record

CVSS 8.8 High

Privilege escalation in the Request Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74954 CVE record

CVSS 7.5 High

Information disclosure due to side-channel in the Storage: Cache API component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74952 CVE record

CVSS 8.8 High

Privilege escalation in the Application Update component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74950 CVE record

CVSS 8.8 High

Privilege escalation in the Downloads API component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74947 CVE record

CVSS 8.8 High

Privilege escalation due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74938 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74937 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-75874 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74990 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74987 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74983 CVE record

CVSS 8.1 High

Mitigation bypass in the Data Loss Prevention component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74976 CVE record

CVSS 6.5 Medium

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74974 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74973 CVE record

CVSS 4.2 Medium

Race condition, use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74972 CVE record

CVSS 4.3 Medium

Information disclosure in the DOM: Push Subscriptions component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74971 CVE record

CVSS 4.3 Medium

Information disclosure in the DOM: UI Events & Focus Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74969 CVE record

CVSS 8.8 High

Race condition, use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026