Mozilla Thunderbird vulnerabilities

CVE-2026-109714 Mozilla Foundation Security Advisory 2026-109: CVE-2026-109714 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109714 Product: Thunderbird Impact: low Fixed in: Thunderbird 158

CVE-2026-117862 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117862 Mozilla Foundation Security Advisory 2026-121 CVE: CVE-2026-117862 Product: Thunderbird Impact: low Fixed in: Thunderbird 159

CVE-2026-117893 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117893 Mozilla Foundation Security Advisory 2026-122 CVE: CVE-2026-117893 Product: Thunderbird Impact: low Fixed in: Thunderbird 153.6

CVE-2026-118009 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118009 Mozilla Foundation Security Advisory 2026-121 CVE: CVE-2026-118009 Product: Thunderbird Impact: low Fixed in: Thunderbird 159

CVE-2026-118026 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118026 Mozilla Foundation Security Advisory 2026-121 CVE: CVE-2026-118026 Product: Thunderbird Impact: low Fixed in: Thunderbird 159

CVE-2026-118025 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118025 Mozilla Foundation Security Advisory 2026-121 CVE: CVE-2026-118025 Product: Thunderbird Impact: low Fixed in: Thunderbird 159

CVE-2026-12311 [MEDIUM] CWE-200 CVE-2026-12311: Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerabi Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2006-6503 [MEDIUM] CWE-254 CVE-2006-6503: Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.

CVE-2012-0456 [MEDIUM] CWE-200 CVE-2012-0456: The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10 The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from process memory via vectors that trigger an out-of-bounds rea

CVE-2008-5510 [MEDIUM] CVE-2008-5510: The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2 The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.

CVE-2013-1693 [MEDIUM] CWE-264 CVE-2013-1693: The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunde The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.

CVE-2012-0447 [MEDIUM] CWE-200 CVE-2012-0447: Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not proper Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image.

CVE-2011-1187 [MEDIUM] CWE-200 CVE-2011-1187: Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspe Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

CVE-2017-5414 [MEDIUM] CWE-200 CVE-2017-5414: The file picker dialog can choose and display the wrong local default directory when instantiated. O The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52.

CVE-2023-4054 [MEDIUM] CVE-2023-4054: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious c When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.

CVE-2011-3653 [MEDIUM] CWE-200 CVE-2011-3653: Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU memory behavior of a certain driver for Intel integrated GPUs, which allows remote attackers to bypass the Same Origin Policy and read image data via vectors related to WebGL textures.

CVE-2015-4519 [MEDIUM] CVE-2015-4519: Mozilla Firefox before 41 Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element.

CVE-2012-3975 [MEDIUM] CWE-200 CVE-2012-3975: The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey befor The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain sensitive information by providing crafted data to privileged extension code.

CVE-2018-5170 [MEDIUM] CWE-20 CVE-2018-5170: It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.

CVE-2024-5691 [MEDIUM] CWE-693 CVE-2024-5691: By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a b By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.