Mozilla
Security Vulnerabilities fixed in Thunderbird 153.6
MFSA2026-122 Oct 27, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-122. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
154 lines
Showing 1–50 of 154 , page 1 of 4
CVE-2026-118174
BR2026-0000-036501
unclaimed
High: Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
Credited as Magnus Melin
CVE-2026-118175
BR2026-0000-036502
unclaimed
High: Content of other messages could be included when replying to a crafted message
Credited as YuYoung Sung
CVE-2026-118176
BR2026-0000-036503
unclaimed
High: Bypass of remote UNC path restriction in mailbox: URLs
Credited as YuYoung Sung
CVE-2026-118177
BR2026-0000-036504
unclaimed
High: Calendar discovery accepted local file and remote network share locations
Credited as Magnus Melin
CVE-2026-118178
BR2026-0000-036505
unclaimed
High: RSS feed could redirect its subscription to a local file or network share
Credited as KhalidAlharthi
CVE-2026-118179
BR2026-0000-036506
unclaimed
Moderate: Request forgery via news: links
Credited as Nguyen Tuan Hung
CVE-2026-118180
BR2026-0000-036507
unclaimed
Moderate: Matrix homeserver could redirect the chat session to a local file or network share
Credited as Magnus Melin
CVE-2026-110247
BR2026-0000-036508
unclaimed
Moderate: Integer overflow in libmime buffer growth could lead to heap corruption
Credited as Ahmed Albalawi <ahmedalbalawij@gmail.com>
CVE-2026-113869
BR2026-0000-036509
unclaimed
Moderate: Use-after-free in S/MIME decryption during a security device password prompt
Credited as Stefan Tatschner
CVE-2026-117860
BR2026-0000-036510
unclaimed
High: Same-origin policy bypass in the DOM: Navigation component
Credited as satyamasd
CVE-2026-117861
BR2026-0000-036511
unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-117862
BR2026-0000-036512
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Networking component
Credited as Mozilla
CVE-2026-117863
BR2026-0000-036513
unclaimed
High: Information disclosure due to uninitialized memory in the Audio/Video component
Credited as Mozilla
CVE-2026-117864
BR2026-0000-036514
unclaimed
High: Sandbox escape in the Form Manager component
Credited as Mozilla
CVE-2026-117865
BR2026-0000-036515
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117866
BR2026-0000-036516
unclaimed
High: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117867
BR2026-0000-036517
unclaimed
High: Use-after-free in the Layout component
Credited as Mozilla
CVE-2026-117868
BR2026-0000-036518
unclaimed
High: Sandbox escape in the DOM: Networking component
Credited as Yaqoub Aldurayhim
CVE-2026-117869
BR2026-0000-036519
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117870
BR2026-0000-036520
unclaimed
High: Use-after-free in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117871
BR2026-0000-036521
unclaimed
High: Invalid pointer in the Graphics component
Credited as Mozilla
CVE-2026-117872
BR2026-0000-036522
unclaimed
High: Use-after-free in the JavaScript: Standard Library component
Credited as Mozilla
CVE-2026-117873
BR2026-0000-036523
unclaimed
High: Incorrect boundary conditions in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117874
BR2026-0000-036524
unclaimed
High: Use-after-free in the Internationalization component
Credited as Mozilla
CVE-2026-117875
BR2026-0000-036525
unclaimed
High: Use-after-free in the Layout: Scrolling and Overflow component
Credited as Mozilla
CVE-2026-117876
BR2026-0000-036526
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Amy Burnett of OpenAI
CVE-2026-117877
BR2026-0000-036527
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117878
BR2026-0000-036528
unclaimed
High: Other issue, use-after-free in the Storage: IndexedDB component
Credited as Amy Burnett of OpenAI
CVE-2026-117879
BR2026-0000-036529
unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Amy Burnett of OpenAI
CVE-2026-117880
BR2026-0000-036530
unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-117881
BR2026-0000-036531
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Amy Burnett of OpenAI
CVE-2026-117882
BR2026-0000-036532
unclaimed
High: Use-after-free in the Layout component
Credited as Amy Burnett of OpenAI
CVE-2026-117883
BR2026-0000-036533
unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Amy Burnett of OpenAI
CVE-2026-117884
BR2026-0000-036534
unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117885
BR2026-0000-036535
unclaimed
High: Use-after-free in the Layout: Grid component
Credited as Mozilla
CVE-2026-117886
BR2026-0000-036536
unclaimed
High: Incorrect boundary conditions in the Graphics: Text component
Credited as tsui
CVE-2026-117887
BR2026-0000-036537
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117888
BR2026-0000-036538
unclaimed
High: Uninitialized memory in the Graphics: Canvas2D component
Credited as Minseong Kim
CVE-2026-117889
BR2026-0000-036539
unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117890
BR2026-0000-036540
unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117891
BR2026-0000-036541
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117892
BR2026-0000-036542
unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Networking component
Credited as Mozilla
CVE-2026-117893
BR2026-0000-036543
unclaimed
High: Incorrect boundary conditions in the Security: PSM component
Credited as Mozilla
CVE-2026-117894
BR2026-0000-036544
unclaimed
High: Incorrect boundary conditions in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117895
BR2026-0000-036545
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117896
BR2026-0000-036546
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117897
BR2026-0000-036547
unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Mozilla
CVE-2026-117898
BR2026-0000-036548
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117899
BR2026-0000-036549
unclaimed
High: Use-after-free in the Networking: HTTP component
Credited as Mozilla
CVE-2026-117900
BR2026-0000-036550
unclaimed
High: Use-after-free in the DOM: Editor component
Credited as Mozilla