BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Thunderbird 159

MFSA2026-121 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-121. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-121/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

173 lines
All 173 CVEs 173 Additional recognition 0 Unclaimed only
Showing 51–100 of 173 , page 2 of 4
CVE-2026-117897 BR2026-0000-036705 unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Mozilla
CVE-2026-117898 BR2026-0000-036706 unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117899 BR2026-0000-036707 unclaimed
High: Use-after-free in the Networking: HTTP component
Credited as Mozilla
CVE-2026-117900 BR2026-0000-036708 unclaimed
High: Use-after-free in the DOM: Editor component
Credited as Mozilla
CVE-2026-117901 BR2026-0000-036709 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117902 BR2026-0000-036710 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117903 BR2026-0000-036711 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117904 BR2026-0000-036712 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117905 BR2026-0000-036713 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117906 BR2026-0000-036714 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as Mozilla
CVE-2026-117907 BR2026-0000-036715 unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117908 BR2026-0000-036716 unclaimed
High: Use-after-free in the Graphics: ImageLib component
Credited as Mozilla
CVE-2026-117909 BR2026-0000-036717 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117910 BR2026-0000-036718 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117911 BR2026-0000-036719 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117912 BR2026-0000-036720 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Takashi Suzuki
CVE-2026-117913 BR2026-0000-036721 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117914 BR2026-0000-036722 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117915 BR2026-0000-036723 unclaimed
High: Incorrect boundary conditions in the Layout: Block and Inline component
Credited as Mozilla
CVE-2026-117916 BR2026-0000-036724 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117917 BR2026-0000-036725 unclaimed
High: Invalid pointer in the Graphics: WebRender component
Credited as Nguyen Tuan Hung
CVE-2026-117918 BR2026-0000-036726 unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117919 BR2026-0000-036727 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117920 BR2026-0000-036728 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Mozilla
CVE-2026-117921 BR2026-0000-036729 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117922 BR2026-0000-036730 unclaimed
High: Use-after-free in the Networking: WebSockets component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117923 BR2026-0000-036731 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117924 BR2026-0000-036732 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117925 BR2026-0000-036733 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117926 BR2026-0000-036734 unclaimed
High: Incorrect boundary conditions in the SVG component
Credited as Mozilla
CVE-2026-117927 BR2026-0000-036735 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117928 BR2026-0000-036736 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Minseong Kim
CVE-2026-117929 BR2026-0000-036737 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117930 BR2026-0000-036738 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117931 BR2026-0000-036739 unclaimed
High: Use-after-free in the DOM: Events component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117932 BR2026-0000-036740 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117933 BR2026-0000-036741 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117934 BR2026-0000-036742 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118011 BR2026-0000-036743 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118012 BR2026-0000-036744 unclaimed
High: Use-after-free in the DOM: Animation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117935 BR2026-0000-036745 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117936 BR2026-0000-036746 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117937 BR2026-0000-036747 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117938 BR2026-0000-036748 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117939 BR2026-0000-036749 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117940 BR2026-0000-036750 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118013 BR2026-0000-036751 unclaimed
High: Use-after-free in the Layout: Images, Video, and HTML Frames component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117941 BR2026-0000-036752 unclaimed
High: Use-after-free in the DOM: CSS Object Model component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117942 BR2026-0000-036753 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118014 BR2026-0000-036754 unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)