Skip to content

Known vulnerabilities in Mozilla Thunderbird

Is your version affected?

CVE Summary Score Published
CVE-2026-100769 Use-after-free in the JavaScript: WebAssembly component 8.8 High Sep 29, 2026
CVE-2026-100768 Use-after-free in the Graphics: WebGPU component 8.8 High Sep 29, 2026
CVE-2026-100767 Use-after-free in the Networking: Cache component 8.8 High Sep 29, 2026
CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component 8.8 High Sep 29, 2026
CVE-2026-100766 Information disclosure in the Networking: JAR component 4.3 Medium Sep 29, 2026
CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component 8.8 High Sep 29, 2026
CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component 9.6 Critical Sep 29, 2026
CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component 9.1 Critical Sep 29, 2026
CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component 9.6 Critical Sep 29, 2026
CVE-2026-100761 Privilege escalation due to use-after-free in the Graphics: WebGPU component 8.8 High Sep 29, 2026
CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component 8.1 High Sep 29, 2026
CVE-2026-100758 Sandbox escape in the DOM: Navigation component 9.6 Critical Sep 29, 2026
CVE-2026-100757 Use-after-free in the Widget component 8.8 High Sep 29, 2026
CVE-2026-100756 Incorrect boundary conditions in the Audio/Video: Playback component 8.1 High Sep 29, 2026
CVE-2026-92240 A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an… 9.1 Critical Sep 15, 2026
CVE-2026-92239 A maliciously constructed IMAP line could cause an out-of-bounds buffer read 8.1 High Sep 15, 2026
CVE-2026-92238 A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety… 9.8 Critical Sep 15, 2026
CVE-2026-92079 Mitigation bypass in the Widget: Win32 component 9.1 Critical Sep 15, 2026
CVE-2026-92078 Denial-of-service in the Security component 6.5 Medium Sep 15, 2026
CVE-2026-92077 Denial-of-service in the SVG component 6.5 Medium Sep 15, 2026
CVE-2026-92076 Incorrect boundary conditions in the Networking component 8.8 High Sep 15, 2026
CVE-2026-92075 Mitigation bypass in the Networking component 9.1 Critical Sep 15, 2026
CVE-2026-92074 Mitigation bypass in the Popup Blocker component 8.8 High Sep 15, 2026
CVE-2026-92073 Privilege escalation in the Enterprise Policies component 8.8 High Sep 15, 2026
CVE-2026-92072 Incorrect boundary conditions in the Safe Browsing component 8.0 High Sep 15, 2026

Other Mozilla products