Thunderbird

Source repositories

https://github.com/mozilla/releases-comm-central

CVEs (1,945)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-2773	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2772	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2771	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2770	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2767	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2766	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2765	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2764	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2763	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2762	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2759	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2758	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2757	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-0892	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Jan 13, 2026	Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147 and…
CVE-2026-0884	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Jan 13, 2026	Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVE-2026-0879	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Jan 13, 2026	Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVE-2025-14330	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Dec 9, 2025	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14326	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Dec 9, 2025	Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
CVE-2025-14324	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Dec 9, 2025	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14321	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Dec 9, 2025	Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

CVE-2026-2773CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2772CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2771CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2770CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2767CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2766CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2765CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2764CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2763CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2762CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2759CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2758CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2757CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-0892CriJan 13, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147 and…
CVE-2026-0884CriJan 13, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVE-2026-0879CriJan 13, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVE-2025-14330CriDec 9, 2025
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14326CriDec 9, 2025
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
CVE-2025-14324CriDec 9, 2025
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14321CriDec 9, 2025
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Page 7 of 98