Mozilla Thunderbird: 25 Vulnerabilities Disclosed, Ranging from Critical to Medium Severity
Mozilla Corporation disclosed 25 vulnerabilities in Thunderbird on August 18, 2026, with critical flaws allowing sandbox escapes and privilege escalation.
Key findings
- Mozilla disclosed 25 vulnerabilities in Thunderbird on August 18, 2026, ranging from medium to critical severity.
- Critical flaws include sandbox escapes and potential memory corruption issues, with CVSS scores up to 10.0.
- Multiple privilege escalation vulnerabilities affect components like Enterprise Policies and Downloads API.
- Information disclosure and site isolation issues were also part of the batch, impacting various components.
- Most vulnerabilities are fixed in Thunderbird 154 and Thunderbird ESR 153.1; users should update promptly.
On August 18, 2026, Mozilla Corporation disclosed a significant batch of 25 vulnerabilities affecting its Thunderbird email client. The vulnerabilities, all disclosed on the same day, range in severity from medium to critical, with several critical flaws carrying CVSS scores of 9.8 and 10.0. These issues impact various components of Thunderbird, including its sandbox, JavaScript engine, and various API implementations, potentially allowing for sandbox escapes, privilege escalation, and information disclosure.
The disclosed vulnerabilities can be broadly categorized by their impact and affected components. A critical sandbox escape was identified in the Remote Settings Client component (CVE-2026-75874). Several other critical vulnerabilities, including those with CVSS scores of 9.8, were found to have evidence of memory corruption or other security-relevant defects, with the potential for exploitation (CVE-2026-74990, CVE-2026-74987).
Privilege escalation is a recurring theme, with multiple CVEs detailing this risk. These include vulnerabilities in the Enterprise Policies component (CVE-2026-74985), Shell Integration (CVE-2026-74965), Request Handling (CVE-2026-74955), Application Update (CVE-2026-74952), and Downloads API (CVE-2026-74950). Additionally, high-severity flaws related to site isolation issues in the Networking: Cookies component (CVE-2026-74962) and same-origin policy bypasses in the DOM: Service Workers component (CVE-2026-74956) were also part of this disclosure.
Information disclosure vulnerabilities were also present, affecting components such as WebRTC (CVE-2026-74958), Storage: Cache API (CVE-2026-74954), DOM: Push Subscriptions (CVE-2026-74972), and DOM: UI Events & Focus Handling (CVE-2026-74971). Other issues included race conditions in the JavaScript Engine (CVE-2026-74984) and various site isolation and same-origin policy bypass issues affecting graphics and audio/video components (CVE-2026-74981, CVE-2026-74970, CVE-2026-74968, CVE-2026-74967). Medium severity bugs also touched upon JIT miscompilation and graphics components.
The majority of these vulnerabilities were addressed in Thunderbird version 154 and Thunderbird ESR 153.1. Some specific fixes also mention Thunderbird 153, Thunderbird 140.14, and Firefox versions, indicating a coordinated release across Mozilla's product lines. Users are strongly advised to update to the latest available versions to mitigate these risks.
This extensive disclosure highlights the ongoing security efforts within Mozilla and the complexity of maintaining security across a widely used email client. The sheer number and severity of the vulnerabilities underscore the importance of prompt patching for all users to protect against potential exploitation and maintain the integrity of their email communications and system security.
The batch includes vulnerabilities such as CVE-2026-75874, CVE-2026-74990, CVE-2026-74989, CVE-2026-74987, CVE-2026-74985, CVE-2026-74984, CVE-2026-74981, CVE-2026-74976, CVE-2026-74974, CVE-2026-74972, CVE-2026-74971, CVE-2026-74970, CVE-2026-74968, CVE-2026-74967, CVE-2026-74966, CVE-2026-74965, CVE-2026-74963, CVE-2026-74962, CVE-2026-74961, CVE-2026-74958, CVE-2026-74956, CVE-2026-74955, CVE-2026-74954, CVE-2026-74952, and CVE-2026-74950.