Mozilla Thunderbird vulnerabilities

CVE-2022-46877 [MEDIUM] CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.

CVE-2023-5726 [MEDIUM] CVE-2023-5726: A website could have obscured the full screen notification by using the file open dialog. This could A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVE-2023-32212 [MEDIUM] CVE-2023-32212: An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerabilit An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVE-2023-32205 [MEDIUM] CVE-2023-32205: In multiple cases browser prompts could have been obscured by popups controlled by content. These co In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVE-2024-0742 [MEDIUM] CVE-2024-0742: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVE-2023-29533 [MEDIUM] CVE-2023-29533: A website could have obscured the fullscreen notification by using a combination of <code>window.ope A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thun

CVE-2022-3034 [MEDIUM] CWE-1021 CVE-2022-3034: When receiving an HTML email that specified to load an <code>iframe</code> element from a remote loc When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

CVE-2024-11701 [MEDIUM] CWE-290 CVE-2024-11701: The incorrect domain may have been displayed in the address bar during an interrupted navigation att The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.

CVE-2024-11159 [MEDIUM] CWE-312 CVE-2024-11159: Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vul Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

CVE-2026-109742 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109742 Mozilla Foundation Security Advisory 2026-110 CVE: CVE-2026-109742 Product: Thunderbird Impact: low Fixed in: Thunderbird 153.5

CVE-2026-109751 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109751 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109751 Product: Thunderbird Impact: low Fixed in: Thunderbird 158

CVE-2026-96869 [MEDIUM] CWE-200 CVE-2026-96869: Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153. Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

CVE-2026-100802 [MEDIUM] CWE-457 CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2026-100799 [MEDIUM] CWE-457 CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2026-12303 [MEDIUM] CWE-125 CVE-2026-12303: Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-109767 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109767 Mozilla Foundation Security Advisory 2026-110 CVE: CVE-2026-109767 Product: Thunderbird Impact: low Fixed in: Thunderbird 153.5

CVE-2026-109777 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109777 Mozilla Foundation Security Advisory 2026-110 CVE: CVE-2026-109777 Product: Thunderbird Impact: low Fixed in: Thunderbird 153.5

CVE-2022-36315 [MEDIUM] CVE-2022-36315: When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with inc When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.

CVE-2026-109771 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109771 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109771 Product: Thunderbird Impact: low Fixed in: Thunderbird 158

CVE-2026-109769 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109769 Mozilla Foundation Security Advisory 2026-109 CVE: CVE-2026-109769 Product: Thunderbird Impact: low Fixed in: Thunderbird 158