CVE-2026-118178

The Thunderbird email client is vulnerable to a flaw where a remote RSS feed can use the itunes:new-feed-url or newLocation element to redirect its subscription URL to a file: URL. This allows an attacker to force Thunderbird to read local files or, on Windows , connect to an attacker-controlled ...