Mozilla Thunderbird vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mozilla Thunderbird: 523 record(s), with affected versions and fixes.cpe:2.3:a:mozilla:thunderbird
CVE-2026-92039
Medium · 6.3
CWE-693 Sep 15, 2026
Mitigation bypass in the DOM: Notifications component
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92038
Critical · 9.1
CWE-693 Sep 15, 2026
Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92037
Critical · 9.8
CWE-119 Sep 15, 2026
Incorrect boundary conditions in the DOM: Animation component
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92036
Critical · 9.8
CWE-119 Sep 15, 2026
Incorrect boundary conditions in the Networking: HTTP component
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92035
Critical · 9.6
CWE-119 Sep 15, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics component
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-92034
Critical · 9.1
CWE-346 Sep 15, 2026
Site isolation issue in the Graphics component
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92032
Critical · 9.6
CWE-119 Sep 15, 2026
Sandbox escape due to invalid pointer in the Graphics component
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92031
Medium · 6.5
CWE-200 Sep 15, 2026
Information disclosure in the Graphics: ImageLib component
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92030
Medium · 5.4
CWE-693 Sep 15, 2026
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92029
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92028
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92027
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92026
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the Networking component
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92025
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the DOM: Navigation component
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92024
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92023
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the XML component
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92022
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92021
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVE-2026-92020
High · 8.8
CWE-120 Sep 15, 2026
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92019
High · 8.1
CWE-693 Sep 15, 2026
Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92018
Critical · 9.6
CWE-693 Sep 15, 2026
Sandbox escape in the DOM: Core & HTML component
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92017
High · 8.8
CWE-269 Sep 15, 2026
Privilege escalation in the DOM: Service Workers component
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92016
High · 8.8
CWE-416 Sep 15, 2026
Use-after-free in the Disability Access APIs component
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92015
High · 8.8
CWE-269 Sep 15, 2026
Privilege escalation in the WebExtensions component
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92014
High · 8.8
CWE-120 Sep 15, 2026
Privilege escalation due to incorrect boundary conditions in the Graphics component
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.