CLSA-2026-1785560172

rebase from Thunderbird 115.4.1 to 140.12.0 ESR

CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked

CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures

CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted

CVE-2023-0616: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions

CVE-2023-1945: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

CVE-2023-4573: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

CVE-2023-4574: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

CVE-2023-4575: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

CVE-2023-4578: When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error

CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

CVE-2023-4581: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

CVE-2023-5169: A compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

CVE-2023-5171: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

CVE-2023-5724: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

CVE-2023-5725: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

CVE-2023-5732: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

CVE-2023-6204: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

CVE-2023-6205: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

CVE-2023-6207: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5

CVE-2023-6208: When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard

CVE-2023-6209: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host

CVE-2023-6212: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2023-6856: The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver

CVE-2023-6857: When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary

CVE-2023-6859: A use-after-free condition affected TLS socket creation when under memory pressure

CVE-2023-6860: The VideoBridge allowed any content process to use textures produced by remote decoders

CVE-2023-6862: A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start- up

CVE-2023-6863: The ShutdownObserver() was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor

CVE-2023-6864: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2023-23598: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7

CVE-2023-23599: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within

CVE-2023-23601: Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7

CVE-2023-23602: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored

CVE-2023-25728: The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect

CVE-2023-25730: A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks

CVE-2023-25737: An invalid downcast from nsTextNode to SVGElement could have lead to undefined behavior

CVE-2023-25742: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash

CVE-2023-25751: Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly

CVE-2023-25752: When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds

CVE-2023-28164: Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks

CVE-2023-29533: A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls

CVE-2023-29535: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced

CVE-2023-29536: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash

CVE-2023-29539: When handling the filename directive in the Content- Disposition header, the filename would be truncated if the filename contained a NULL character

CVE-2023-29548: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result

CVE-2023-32206: An out-of-bound read could have led to a crash in the RLBox Expat driver

CVE-2023-32211: A type checking bug would have led to invalid code being compiled

CVE-2023-37207: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks

CVE-2023-50761: The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time

CVE-2023-50762: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user

CVE-2024-0746: A Linux user opening the print preview dialog could have caused the browser to crash

CVE-2024-0750: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions

CVE-2024-0751: A malicious devtools extension could have been used to escalate privileges

CVE-2024-1546: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of- bounds memory read

CVE-2024-1547: Through a series of API calls and redirects, an attacker- controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8

CVE-2024-1548: A website could have obscured the fullscreen notification by using a dropdown select input element

CVE-2024-1549: If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions

CVE-2024-1550: A malicious website could have used a combination of exiting fullscreen mode and requestPointerLock to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant

CVE-2024-1551: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses

CVE-2024-1553: Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-2608: AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write

CVE-2024-2609: The permission prompt input delay could expire while the window is not in focus

CVE-2024-2610: Using a markup injection an attacker could have stolen nonce values

CVE-2024-2611: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions

CVE-2024-2612: If an attacker could find a way to trigger a particular code path in SafeRefPtr, it could have triggered a crash or potentially be leveraged to achieve code execution

CVE-2024-2614: Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-2616: To harden ICU against exploitation, the behavior for out- of-memory conditions was changed to crash instead of attempt to continue

CVE-2024-3302: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed

CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied

CVE-2024-3857: The JIT created incorrect code for arguments in certain cases

CVE-2024-3859: On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font

CVE-2024-3861: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use- after-free

CVE-2024-3864: Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code

CVE-2024-4767: If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed

CVE-2024-4768: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions

CVE-2024-4769: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses

CVE-2024-4770: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash

CVE-2024-4777: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-5688: If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant

CVE-2024-5690: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system

CVE-2024-5691: By tricking the browser with a X-Frame-Options header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window

CVE-2024-5693: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy

CVE-2024-5696: By manipulating the text in an <input> tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash

CVE-2024-5700: Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-6600: Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on macOS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128

CVE-2024-6601: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin

CVE-2024-6602: A mismatch between allocator and deallocator could have led to memory corruption

CVE-2024-6603: In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption

CVE-2024-6604: Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-6606: Clipboard code failed to check the index on an array access

CVE-2024-6607: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a <select> element over certain permission prompts

CVE-2024-6608: It was possible to move the cursor using pointerlock from an iframe

CVE-2024-6609: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again

CVE-2024-6610: Form validation popups could capture escape key presses

CVE-2024-6611: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

CVE-2024-6612: CSP violations generated links in the console tab of the developer tools, pointing to the violating resource

CVE-2024-6613: The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces

CVE-2024-6614: The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces

CVE-2024-7518: Select options could obscure the fullscreen notification dialog

CVE-2024-7521: Incomplete WebAssembly exception handing could have led to a use-after-free

CVE-2024-7522: Editor code failed to check an attribute value

CVE-2024-7525: It was possible for a web extension with minimal permissions to create a StreamFilter which could be used to read and modify the response body of requests on any site

CVE-2024-7526: ANGLE failed to initialize parameters which lead to reading from uninitialized memory

CVE-2024-7527: Unexpected marking work at the start of sweeping could have led to a use-after-free

CVE-2024-7529: The date picker could partially obscure security prompts

CVE-2024-7652: An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash

CVE-2024-8394: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash

CVE-2024-9392: A compromised content process could have allowed for the arbitrary loading of cross-origin pages

CVE-2024-9393: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin

CVE-2024-9394: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin

CVE-2024-9396: It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption

CVE-2024-9397: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking

CVE-2024-9398: By checking the result of calls to window.open with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed

CVE-2024-9399: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition

CVE-2024-9400: A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation

CVE-2024-9401: Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-10458: A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements

CVE-2024-10459: An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash

CVE-2024-10460: The origin of an external protocol handler prompt could have been obscured using a data: URL within an iframe. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132

CVE-2024-10461: In multipart/x-mixed-replace responses, Content- Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks

CVE-2024-10462: Truncation of a long URL could have allowed origin spoofing in a permission prompt

CVE-2024-10463: Video frames could have been leaked between origins in some situations

CVE-2024-10464: Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser

CVE-2024-10465: A clipboard "paste" button could persist across tabs which allowed a spoofing attack

CVE-2024-10466: By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive

CVE-2024-10467: Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2024-10468: Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash

CVE-2024-11159: Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext

CVE-2024-11692: An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks

CVE-2024-11693: The executable file warning was not presented when downloading .library-ms files

CVE-2024-11694: Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension

CVE-2024-11695: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack

CVE-2024-11696: The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification

CVE-2024-11697: When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog

CVE-2024-11700: Malicious websites may have been able to perform user intent confirmation through tapjacking

CVE-2024-11701: The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt

CVE-2024-11702: Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled

CVE-2024-11704: A double-free issue could have occurred in sec_pkcs7_decoder_start_decrypt() when handling an error path

CVE-2024-11705: NSC_DeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes

CVE-2024-11706: A null pointer dereference may have inadvertently occurred in pk12util, and specifically in the SEC_ASN1DecodeItem_Util function, when handling malformed or improperly formatted input files

CVE-2024-11708: Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure

CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks

CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash

CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site

CVE-2025-0240: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use- after-free

CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash

CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-0247: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-0510: Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040

CVE-2025-1009: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash

CVE-2025-1010: An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash

CVE-2025-1012: A race during concurrent delazification could have led to a use-after-free

CVE-2025-1013: A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak

CVE-2025-1014: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed

CVE-2025-1015: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript

CVE-2025-1016: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-1018: The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack

CVE-2025-1019: The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack

CVE-2025-1931: It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash

CVE-2025-1932: An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later

CVE-2025-1933: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type

CVE-2025-1934: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it

CVE-2025-1935: A web page could trick a user into setting that site as the default handler for a custom URL protocol

CVE-2025-1936: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image

CVE-2025-1937: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-1938: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-1942: When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string

CVE-2025-3028: JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free

CVE-2025-3029: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack

CVE-2025-3030: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-3031: An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function

CVE-2025-3032: Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks

CVE-2025-3033: This bug only affects Firefox on Windows. Other operating systems are unaffected.*

CVE-2025-5262: A double-free could have occurred in vpx_codec_enc_init_multi after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash

CVE-2025-5986: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content

CVE-2025-8027: On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits

CVE-2025-8028: On arm64, a WASM br_table instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address

CVE-2025-8029: Thunderbird executed javascript: URLs when used in object and embed tags

CVE-2025-8030: Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code

CVE-2025-8031: The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials

CVE-2025-8032: XSLT document loading did not correctly propagate the source document which bypassed its CSP

CVE-2025-8033: The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref

CVE-2025-8034: Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-8035: Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-8036: Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding

CVE-2025-8037: Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute

CVE-2025-9179: An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process

CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component

CVE-2025-9181: Uninitialized memory in the JavaScript Engine component

CVE-2025-9182: Denial-of-service due to out-of-memory in the Graphics: WebRender component

CVE-2025-9184: Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-9185: Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-10527: Sandbox escape due to use-after-free in the Graphics: Canvas2D component

CVE-2025-10528: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component

CVE-2025-10529: Same-origin policy bypass in the Layout component

CVE-2025-10532: Incorrect boundary conditions in the JavaScript: GC component

CVE-2025-10533: Integer overflow in the SVG component

CVE-2025-10536: Information disclosure in the Networking: Cache component

CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance()

CVE-2025-11709: A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures

CVE-2025-11710: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process

CVE-2025-11711: There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable

CVE-2025-11712: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header

CVE-2025-11713: Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems

CVE-2025-11714: Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2025-14322: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

CVE-2025-14323: Privilege escalation in the DOM: Notifications component

CVE-2025-14328: Privilege escalation in the Netmonitor component

CVE-2025-14329: Privilege escalation in the Netmonitor component

CVE-2025-14331: Same-origin policy bypass in the Request Handling component

CVE-2025-26695: When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address

CVE-2025-26696: Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted

CVE-2026-0818: When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email

CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the Graphics component

CVE-2026-0882: Use-after-free in the IPC component

CVE-2026-0883: Information disclosure in the Networking component

CVE-2026-0884: Use-after-free in the JavaScript Engine component

CVE-2026-0885: Use-after-free in the JavaScript: GC component

CVE-2026-0886: Incorrect boundary conditions in the Graphics component

CVE-2026-0887: Clickjacking issue, information disclosure in the PDF Viewer component

CVE-2026-0890: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

CVE-2026-2447: Heap buffer overflow in libvpx

CVE-2026-2769: Use-after-free in the Storage: IndexedDB component

CVE-2026-2772: Use-after-free in the Audio/Video: Playback component

CVE-2026-2773: Incorrect boundary conditions in the Web Audio component

CVE-2026-2774: Integer overflow in the Audio/Video component

CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR component

CVE-2026-2782: Privilege escalation in the Netmonitor component

CVE-2026-2786: Use-after-free in the JavaScript Engine component

CVE-2026-2787: Use-after-free in the DOM: Window and Location component

CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP component

CVE-2026-2789: Use-after-free in the Graphics: ImageLib component

CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component

CVE-2026-3889: Spoofing issue in Thunderbird

CVE-2026-4371: A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data

CVE-2026-4692: Sandbox escape in the Responsive Design Mode component

CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component

CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component

CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component

CVE-2026-4721: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2026-5731: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2026-8090: Use-after-free in the DOM: Networking component

CVE-2026-8091: Incorrect boundary conditions in the Audio/Video: Playback component

CVE-2026-8092: Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code

CVE-2026-8094: Other issue in the WebRTC component

CVE-2026-12289: Privilege escalation in the Graphics: WebRender component

CVE-2026-12305: Memory safety bug fixed in Firefox 152

CVE-2026-12306: Memory safety bug fixed in Firefox 152

CVE-2026-12309: Memory safety bug fixed in Firefox 152

CVE-2026-12324: Incorrect boundary conditions in the Graphics: CanvasWebGL component