Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-2770 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Bindings (WebIDL) component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2769 CVE record

CVSS 8.8 High

Use-after-free in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2768 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
Not analysed yet 24 Feb 2026
CVE-2026-2767 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2766 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2765 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2764 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2763 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2762 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the JavaScript: Standard Library component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2761 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 24 Feb 2026
CVE-2026-2760 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1384
Not analysed yet 24 Feb 2026
CVE-2026-2759 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1384
Not analysed yet 24 Feb 2026
CVE-2026-2758 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 24 Feb 2026
CVE-2026-2757 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the WebRTC: Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1384
Not analysed yet 24 Feb 2026
CVE-2026-2447 CVE record

CVSS 8.8 High

Heap buffer overflow in libvpx
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Feb 2026
CVE-2026-0818 CVE record

CVSS 4.3 Medium

CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
- Mozilla Thunderbird
- Information disclosure
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jan 2026
CVE-2026-0892 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0891 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0890 CVE record

CVSS 5.4 Medium

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 13 Jan 2026
CVE-2026-0889 CVE record

CVSS 7.5 High

Denial-of-service in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 13 Jan 2026
CVE-2026-0888 CVE record

CVSS 5.3 Medium

Information disclosure in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Jan 2026
CVE-2026-0887 CVE record

CVSS 4.3 Medium

Clickjacking issue, information disclosure in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Jan 2026
CVE-2026-0886 CVE record

CVSS 5.3 Medium

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0885 CVE record

CVSS 6.5 Medium

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0884 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0883 CVE record

CVSS 5.3 Medium

Information disclosure in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Jan 2026
CVE-2026-0882 CVE record

CVSS 8.8 High

Use-after-free in the IPC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0881 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape in the Messaging System component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
Not analysed yet 13 Jan 2026
CVE-2026-0880 CVE record

CVSS 8.8 High

Sandbox escape due to integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0879 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Jan 2026
CVE-2026-0878 CVE record

CVSS 8.0 High

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-20
Not analysed yet 13 Jan 2026
CVE-2026-0877 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 13 Jan 2026
CVE-2025-14333 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Dec 2025
CVE-2025-14332 CVE record

CVSS 7.3 High

Memory safety bugs fixed in Firefox 146 and Thunderbird 146
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Dec 2025
CVE-2025-14331 CVE record

CVSS 6.5 Medium

Same-origin policy bypass in the Request Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 9 Dec 2025
CVE-2025-14330 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-686
Not analysed yet 9 Dec 2025
CVE-2025-14329 CVE record

CVSS 8.8 High

Privilege escalation in the Netmonitor component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 9 Dec 2025
CVE-2025-14328 CVE record

CVSS 8.8 High

Privilege escalation in the Netmonitor component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 9 Dec 2025
CVE-2025-14327 CVE record

CVSS 7.5 High

Spoofing issue in the Downloads Panel component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 9 Dec 2025
CVE-2025-14326 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Dec 2025
CVE-2025-14325 CVE record

CVSS 7.3 High

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Dec 2025
CVE-2025-14324 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 9 Dec 2025
CVE-2025-14323 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Notifications component
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 9 Dec 2025
CVE-2025-14322 CVE record

CVSS 8.0 High

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 9 Dec 2025
CVE-2025-14321 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Dec 2025
CVE-2025-13027 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 11 Nov 2025
CVE-2025-13020 CVE record

CVSS 8.8 High

Use-after-free in the WebRTC: Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 11 Nov 2025
CVE-2025-13019 CVE record

CVSS 8.1 High

Same-origin policy bypass in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-942
Not analysed yet 11 Nov 2025
CVE-2025-13018 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 11 Nov 2025
CVE-2025-13017 CVE record

CVSS 8.1 High

Same-origin policy bypass in the DOM: Notifications component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-942
Not analysed yet 11 Nov 2025
CVE-2025-13026 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 11 Nov 2025
CVE-2025-13025 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 11 Nov 2025
CVE-2025-13024 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-733
Not analysed yet 11 Nov 2025
CVE-2025-13016 CVE record

CVSS 7.5 High

Incorrect boundary conditions in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 11 Nov 2025
CVE-2025-13023 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 11 Nov 2025
CVE-2025-13022 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 11 Nov 2025
CVE-2025-13021 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-703
Not analysed yet 11 Nov 2025
CVE-2025-13014 CVE record

CVSS 8.8 High

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 11 Nov 2025
CVE-2025-13013 CVE record

CVSS 6.1 Medium

Mitigation bypass in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 11 Nov 2025
CVE-2025-13012 CVE record

CVSS 7.5 High

Race condition in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 11 Nov 2025