CVE-2025-3932

It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web...

CVE-2025-3932

The CVE-2025-3932 issue concerns Thunderbird where an email could display a tracking link as an attachment; when opened, Thunderbird could access the external URL via the X-Mozilla-External-Attachment-URL header despite remote content blocking. Affected products: Thunderbird versions earlier than...

CVE-2025-24172

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. "Block All Remote Content" may not apply for all mail previews...