Mozilla
Security Vulnerabilities fixed in Thunderbird 159
MFSA2026-121 Oct 27, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-121. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-121/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
173 lines
Showing 1–50 of 173 , page 1 of 4
CVE-2026-118174
BR2026-0000-036655
unclaimed
High: Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
Credited as Magnus Melin
CVE-2026-118175
BR2026-0000-036656
unclaimed
High: Content of other messages could be included when replying to a crafted message
Credited as YuYoung Sung
CVE-2026-118176
BR2026-0000-036657
unclaimed
High: Bypass of remote UNC path restriction in mailbox: URLs
Credited as YuYoung Sung
CVE-2026-118177
BR2026-0000-036658
unclaimed
High: Calendar discovery accepted local file and remote network share locations
Credited as Magnus Melin
CVE-2026-118178
BR2026-0000-036659
unclaimed
High: RSS feed could redirect its subscription to a local file or network share
Credited as KhalidAlharthi
CVE-2026-118179
BR2026-0000-036660
unclaimed
Moderate: Request forgery via news: links
Credited as Nguyen Tuan Hung
CVE-2026-118180
BR2026-0000-036661
unclaimed
Moderate: Matrix homeserver could redirect the chat session to a local file or network share
Credited as Magnus Melin
CVE-2026-117860
BR2026-0000-036662
unclaimed
High: Same-origin policy bypass in the DOM: Navigation component
Credited as satyamasd
CVE-2026-117861
BR2026-0000-036663
unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-117862
BR2026-0000-036664
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Networking component
Credited as Mozilla
CVE-2026-117863
BR2026-0000-036665
unclaimed
High: Information disclosure due to uninitialized memory in the Audio/Video component
Credited as Mozilla
CVE-2026-117864
BR2026-0000-036666
unclaimed
High: Sandbox escape in the Form Manager component
Credited as Mozilla
CVE-2026-117865
BR2026-0000-036667
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117866
BR2026-0000-036668
unclaimed
High: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117867
BR2026-0000-036669
unclaimed
High: Use-after-free in the Layout component
Credited as Mozilla
CVE-2026-117868
BR2026-0000-036670
unclaimed
High: Sandbox escape in the DOM: Networking component
Credited as Yaqoub Aldurayhim
CVE-2026-117869
BR2026-0000-036671
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117870
BR2026-0000-036672
unclaimed
High: Use-after-free in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117871
BR2026-0000-036673
unclaimed
High: Invalid pointer in the Graphics component
Credited as Mozilla
CVE-2026-117872
BR2026-0000-036674
unclaimed
High: Use-after-free in the JavaScript: Standard Library component
Credited as Mozilla
CVE-2026-117873
BR2026-0000-036675
unclaimed
High: Incorrect boundary conditions in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-118005
BR2026-0000-036676
unclaimed
High: Use-after-free in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117874
BR2026-0000-036677
unclaimed
High: Use-after-free in the Internationalization component
Credited as Mozilla
CVE-2026-117875
BR2026-0000-036678
unclaimed
High: Use-after-free in the Layout: Scrolling and Overflow component
Credited as Mozilla
CVE-2026-117876
BR2026-0000-036679
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Amy Burnett of OpenAI
CVE-2026-118006
BR2026-0000-036680
unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117877
BR2026-0000-036681
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-118007
BR2026-0000-036682
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117878
BR2026-0000-036683
unclaimed
High: Other issue, use-after-free in the Storage: IndexedDB component
Credited as Amy Burnett of OpenAI
CVE-2026-117879
BR2026-0000-036684
unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Amy Burnett of OpenAI
CVE-2026-118008
BR2026-0000-036685
unclaimed
High: Privilege escalation in the DOM: Navigation component
Credited as Amy Burnett of OpenAI
CVE-2026-117880
BR2026-0000-036686
unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-118009
BR2026-0000-036687
unclaimed
High: Integer overflow, use-after-free in the Graphics: Text component
Credited as Nguyen Thanh Nguyen
CVE-2026-117881
BR2026-0000-036688
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Amy Burnett of OpenAI
CVE-2026-117882
BR2026-0000-036689
unclaimed
High: Use-after-free in the Layout component
Credited as Amy Burnett of OpenAI
CVE-2026-117883
BR2026-0000-036690
unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Amy Burnett of OpenAI
CVE-2026-117884
BR2026-0000-036691
unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117885
BR2026-0000-036692
unclaimed
High: Use-after-free in the Layout: Grid component
Credited as Mozilla
CVE-2026-117886
BR2026-0000-036693
unclaimed
High: Incorrect boundary conditions in the Graphics: Text component
Credited as tsui
CVE-2026-117887
BR2026-0000-036694
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-118010
BR2026-0000-036695
unclaimed
High: Use-after-free in the Disability Access APIs component
Credited as Mozilla
CVE-2026-117888
BR2026-0000-036696
unclaimed
High: Uninitialized memory in the Graphics: Canvas2D component
Credited as Minseong Kim
CVE-2026-117889
BR2026-0000-036697
unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117890
BR2026-0000-036698
unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117891
BR2026-0000-036699
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117892
BR2026-0000-036700
unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Networking component
Credited as Mozilla
CVE-2026-117893
BR2026-0000-036701
unclaimed
High: Incorrect boundary conditions in the Security: PSM component
Credited as Mozilla
CVE-2026-117894
BR2026-0000-036702
unclaimed
High: Incorrect boundary conditions in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117895
BR2026-0000-036703
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117896
BR2026-0000-036704
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla