Thunderbird vulnerabilities

801 known vulnerabilities in Thunderbird from Mozilla. 800 are rated high or critical, and 14 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Firefox: Integer Overflow or Wraparound

  CVE-2026-74964Aug 18, 2026Mozilla

  Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.1 High severity

  Firefox: Origin Validation Error

  CVE-2026-74962Aug 18, 2026Mozilla

  Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.1 High severity

  Firefox: Improper Access Control

  CVE-2026-74960Aug 18, 2026Mozilla

  Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 9.1 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-74959Aug 18, 2026Mozilla

  Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 7.5 High severity

  Firefox: Improper Restriction of Rendered UI Layers or Frames

  CVE-2026-74958Aug 18, 2026Mozilla

  Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.1 High severity

  Firefox: Protection Mechanism Failure

  CVE-2026-74957Aug 18, 2026Mozilla

  Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 9.1 Critical severity

  Firefox: Access of Resource Using Incompatible Type

  CVE-2026-74956Aug 18, 2026Mozilla

  Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74955Aug 18, 2026Mozilla

  Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 7.5 High severity

  Firefox: Observable Discrepancy

  CVE-2026-74954Aug 18, 2026Mozilla

  Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74953Aug 18, 2026Mozilla

  Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74952Aug 18, 2026Mozilla

  Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74950Aug 18, 2026Mozilla

  Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-74949Aug 18, 2026Mozilla

  Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Release of Invalid Pointer or Reference

  CVE-2026-74947Aug 18, 2026Mozilla

  Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-74946Aug 18, 2026Mozilla

  Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153

• 9.8 Critical severity

  Firefox: Use After Free

  CVE-2026-74944Aug 18, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 9.8 Critical severity

  Firefox: Use After Free

  CVE-2026-74943Aug 18, 2026Mozilla

  Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74942Aug 18, 2026Mozilla

  Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74941Aug 18, 2026Mozilla

  Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 9.8 Critical severity

  Firefox: Use After Free

  CVE-2026-74940Aug 18, 2026Mozilla

  Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74939Aug 18, 2026Mozilla

  Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 9.1 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-74938Aug 18, 2026Mozilla

  Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-74937Aug 18, 2026Mozilla

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• 9.8 Critical severity

  Firefox: Use After Free

  CVE-2026-74936Aug 18, 2026Mozilla

  Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-74935Aug 18, 2026Mozilla

  Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 7.5 High severity

  Firefox: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-74934Aug 18, 2026Mozilla

  Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

• 7.5 High severity

  Thunderbird: Off-by-one Error

  CVE-2026-14899Jul 22, 2026Mozilla

  The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderb

• 9.8 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-16412Jul 21, 2026Mozilla

  Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed

• 9.8 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-16411Jul 21, 2026Mozilla

  Memory safety bugs present in Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunder

• 7.5 High severity

  Firefox: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-16405Jul 21, 2026Mozilla

  Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 7.5 High severity

  Firefox: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-16391Jul 21, 2026Mozilla

  Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 9.1 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-16390Jul 21, 2026Mozilla

  Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 9.8 Critical severity

  Firefox: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-16387Jul 21, 2026Mozilla

  Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 7.5 High severity

  Firefox: Use of Uninitialized Resource

  CVE-2026-16386Jul 21, 2026Mozilla

  Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

• 7.5 High severity

  Firefox: Use of Uninitialized Resource

  CVE-2026-16385Jul 21, 2026Mozilla

  Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

• 7.5 High severity

  Firefox: Use of Uninitialized Resource

  CVE-2026-16384Jul 21, 2026Mozilla

  Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

• 9.8 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-16383Jul 21, 2026Mozilla

  Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 9.1 Critical severity

  Firefox: Origin Validation Error

  CVE-2026-16381Jul 21, 2026Mozilla

  Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-16379Jul 21, 2026Mozilla

  Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

• 9.8 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-16377Jul 21, 2026Mozilla

  Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.