Mozilla Thunderbird vulnerabilities
2,339 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,339
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH765MEDIUM746LOW29UNKNOWN60
Vulnerabilities
Page 22 of 117
CVE-2025-1011P3HIGHCVSS 8.8fixed in 135.0≥ 128.0.1, < 128.7.02025-02-04
CVE-2025-1011 [HIGH] CWE-94 CVE-2025-1011: A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an at
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
nvdosv
CVE-2024-8382P3HIGHCVSS 8.8≥ unspecified, < 128.2≥ unspecified, < 115.152024-09-03
CVE-2024-8382 [HIGH] CWE-273 CVE-2024-8382: Internal browser event interfaces were exposed to web content when privileged EventHandler listener
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools consol
nvdosv
CVE-2011-2984P3CRITICALCVSS 10.0v3.0v3.0.1+22 more2011-08-18
CVE-2011-2984 [CRITICAL] CWE-94 CVE-2011-2984: Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other prod
Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events.
nvd
CVE-2026-74946P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74946 [HIGH] CWE-119 CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74941P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74941 [HIGH] CWE-269 CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74939P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74939 [HIGH] CWE-269 CVE-2026-74939: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74935P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74935 [HIGH] CWE-269 CVE-2026-74935: Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16396P3HIGHCVSS 8.8fixed in 140.13.0≥ 141.0, < 153.02026-07-21
CVE-2026-16396 [HIGH] CWE-269 CVE-2026-16396: Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2012-3990P3CRITICALCVSS 9.3fixed in 16.02012-10-10
CVE-2012-3990 [CRITICAL] CWE-416 CVE-2012-3990: Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0,
Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
nvd
CVE-2026-16362P3HIGHCVSS 8.8fixed in 140.13.0≥ 141.0, < 153.02026-07-21
CVE-2026-16362 [HIGH] CWE-416 CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Fi
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-74955P3HIGHCVSS 8.8fixed in 153.1.0fixed in 154.02026-08-18
CVE-2026-74955 [HIGH] CWE-269 CVE-2026-74955: Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16372P3HIGHCVSS 8.8fixed in 153.02026-07-21
CVE-2026-16372 [HIGH] CWE-269 CVE-2026-16372: Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefo
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2025-14328P3HIGHCVSS 8.8fixed in 140.6.0fixed in 146.02025-12-09
CVE-2025-14328 [HIGH] CVE-2025-14328: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firef
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
nvdosv
CVE-2025-14329P3HIGHCVSS 8.8fixed in 140.6.0fixed in 146.02025-12-09
CVE-2025-14329 [HIGH] CVE-2025-14329: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firef
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
nvdosv
CVE-2026-100773P3HIGHCVSS 8.8≥ 140.0, < 140.17.0≥ 153.0, < 153.4.0+1 more2026-09-29
CVE-2026-100773 [HIGH] CWE-416 CVE-2026-100773: Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100791P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100791 [HIGH] CWE-416 CVE-2026-100791: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-8955P3HIGHCVSS 8.8fixed in 140.11fixed in 151.0.02026-05-19
CVE-2026-8955 [HIGH] CWE-269 CVE-2026-8955: Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Fir
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
nvdmozilla
CVE-2026-12291P3HIGHCVSS 8.8fixed in 140.12.0fixed in 152.0.02026-06-16
CVE-2026-12291 [HIGH] CWE-416 CVE-2026-12291: Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firef
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
nvdmozilla
CVE-2025-8040P3HIGHCVSS 8.8fixed in 140.1fixed in 141.02025-07-22
CVE-2025-8040 [HIGH] CWE-119 CVE-2025-8040: Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderb
nvdosv
CVE-2025-10537P3HIGHCVSS 8.8fixed in 140.3.0fixed in 143.02025-09-16
CVE-2025-10537 [HIGH] CWE-119 CVE-2025-10537: Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunde
nvdosv