CVE-2026-3889 Spoofing issue in Thunderbird

Description

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Affected products and versions

Product	Affected versions	Fixed in
Thunderbird 149	earliest → < 149	149
Thunderbird 140.9	earliest → < 140.9	140.9

Other CVEs of Thunderbird

The 1713 CVEs of Thunderbird →

CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share 7.5 High CVE-2026-118179 Request forgery via news: links 8.8 High CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share 5.7 Medium CVE-2026-118177 Calendar discovery accepted local file and remote network share locations 9.1 Critical