Thunderbird

Source repositories

https://github.com/mozilla/releases-comm-central

CVEs (2,164)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-84128	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 1, 2026	Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84123	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 1, 2026	Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-74965	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74955	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74952	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
CVE-2026-74950	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74949	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74947	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74946	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74941	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74937	Mozilla Corporation Firefox	Hig	0.57	8.8	Aug 18, 2026	Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-16401	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16396	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16379	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16372	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16371	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16366	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16365	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16362	Mozilla Corporation Firefox	Hig	0.57	8.8	Jul 21, 2026	Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-12291	Mozilla Corporation Firefox	Hig	0.57	8.8	Jun 16, 2026	Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-84128HigSep 1, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84123HigSep 1, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-74965HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74955HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74952HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
CVE-2026-74950HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74949HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74947HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74946HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74941HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74937HigAug 18, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-16401HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16396HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16379HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16372HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16371HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16366HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16365HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16362HigJul 21, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-12291HigJun 16, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Page 27 of 109