Mozilla Thunderbird
2142 CVEs affecting Mozilla Thunderbird. Latest disclosed: 2026-09-30. Critical: 406, High: 640.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75874 | Critical | 10.0 | 2026-08-18 | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, F… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-4725 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4692 | Critical | 10.0 | 2026-03-24 | Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, an… |
CVE-2026-4689 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34… |
CVE-2026-4688 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149… |
CVE-2026-2778 | Critical | 10.0 | 2026-02-24 | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox… |
CVE-2026-2776 | Critical | 10.0 | 2026-02-24 | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 1… |
CVE-2026-2768 | Critical | 10.0 | 2026-02-24 | Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2761 | Critical | 10.0 | 2026-02-24 | Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and T… |
CVE-2026-2760 | Critical | 10.0 | 2026-02-24 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Fire… |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2021-4140 | Critical | 10.0 | 2022-12-22 | It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96… |
CVE-2021-38503 | Critical | 10.0 | 2021-12-08 | The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the… |
CVE-2019-11708 | Critical | 10.0 | 2019-07-23 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
CVE-2018-18505 | Critical | 10.0 | 2019-02-05 | An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
CVE-2026-100810 | Critical | 9.8 | 2026-09-29 | Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-92238 | Critical | 9.8 | 2026-09-15 | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in… |
CVE-2026-92066 | Critical | 9.8 | 2026-09-15 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92061 | Critical | 9.8 | 2026-09-15 | Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |