Thunderbird vulnerabilities

801 known vulnerabilities in Thunderbird from Mozilla. 800 are rated high or critical, and 14 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

801vulnerabilities

229critical

571high

14exploited

8.7average CVSS score

Latest first

10.0 Critical severity
Firefox: Use After Free
CVE-2026-4688Mar 24, 2026Mozilla
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
8.6 High severity
Firefox: Improper Check for Unusual or Exceptional Conditions
CVE-2026-4687Mar 24, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
7.5 High severity
Firefox: Improper Check for Unusual or Exceptional Conditions
CVE-2026-4686Mar 24, 2026Mozilla
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
7.5 High severity
Firefox: Improper Check for Unusual or Exceptional Conditions
CVE-2026-4685Mar 24, 2026Mozilla
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
7.5 High severity
Firefox: Concurrent Execution using Shared Resource with Improper Synchronization
CVE-2026-4684Mar 24, 2026Mozilla
Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
9.8 Critical severity
Firefox: Out-of-bounds Write
CVE-2026-2807Feb 24, 2026Mozilla
Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox
9.8 Critical severity
Firefox: Out-of-bounds Write
CVE-2026-2793Feb 24, 2026Mozilla
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited
9.8 Critical severity
Firefox: Out-of-bounds Write
CVE-2026-2792Feb 24, 2026Mozilla
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod
9.8 Critical severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
CVE-2026-2791Feb 24, 2026Mozilla
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Origin Validation Error
CVE-2026-2790Feb 24, 2026Mozilla
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2789Feb 24, 2026Mozilla
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-2788Feb 24, 2026Mozilla
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2787Feb 24, 2026Mozilla
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2786Feb 24, 2026Mozilla
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Access of Uninitialized Pointer
CVE-2026-2785Feb 24, 2026Mozilla
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
CVE-2026-2784Feb 24, 2026Mozilla
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
7.5 High severity
Firefox: Access of Resource Using Incompatible Type
CVE-2026-2783Feb 24, 2026Mozilla
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Improper Privilege Management
CVE-2026-2782Feb 24, 2026Mozilla
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Integer Overflow or Wraparound
CVE-2026-2781Feb 24, 2026Mozilla
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
9.8 Critical severity
Firefox: Improper Privilege Management
CVE-2026-2780Feb 24, 2026Mozilla
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-2779Feb 24, 2026Mozilla
Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
10.0 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-2778Feb 24, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Improper Privilege Management
CVE-2026-2777Feb 24, 2026Mozilla
Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
10.0 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-2776Feb 24, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
CVE-2026-2775Feb 24, 2026Mozilla
Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Integer Overflow or Wraparound
CVE-2026-2774Feb 24, 2026Mozilla
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-2773Feb 24, 2026Mozilla
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2772Feb 24, 2026Mozilla
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Out-of-bounds Read
CVE-2026-2771Feb 24, 2026Mozilla
Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2770Feb 24, 2026Mozilla
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
7.5 High severity
Firefox: Use After Free
CVE-2026-2769Feb 24, 2026Mozilla
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
10.0 Critical severity
Firefox: Improper Access Control
CVE-2026-2768Feb 24, 2026Mozilla
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2767Feb 24, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2766Feb 24, 2026Mozilla
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2765Feb 24, 2026Mozilla
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2764Feb 24, 2026Mozilla
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Use After Free
CVE-2026-2763Feb 24, 2026Mozilla
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
9.8 Critical severity
Firefox: Integer Overflow or Wraparound
CVE-2026-2762Feb 24, 2026Mozilla
Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
10.0 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-2761Feb 24, 2026Mozilla
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
10.0 Critical severity
Firefox: Improper Handling of Physical or Environmental Conditions
CVE-2026-2760Feb 24, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.