CVE-2026-100829

A mitigation bypass exists in the DOM: Security component of certain Mozilla products. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While the vulnerability is confirmed through multiple sources, specific technical details reg...

CVE-2026-100817

The JavaScript: WebAssembly component contains an issue affecting Mozilla Thunderbird and Firefox . This vulnerability was addressed in both products starting with version 157 . No specific root cause or exploitation details are provided in the documents. Sighting data confirms the vulnerability ...

CVE-2026-92239

A maliciously constructed IMAP line in Mozilla Thunderbird could cause an out-of-bounds buffer read . This vulnerability impacts versions prior to 156 , 140.16 , and 153.3 . Remediation is available in Thunderbird versions 156 , 140.16 , and 153.3 . Specific distribution packages, such as Debian ...

CVE-2026-100760

A sandbox escape vulnerability exists in the Security: Process Sandboxing component of Mozilla products. This flaw allows an attacker to bypass security restrictions, potentially leading to significant impacts including arbitrary code execution , information disclosure , denial of service , and u...

CVE-2026-92014

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics component . This issue is addressed in Firefox ESR 115.41 , Firefox ESR 140.16 , and Thunderbird 140.16 . No specific exploit details or in-the-wild exp...

CVE-2026-4371

The Mozilla Thunderbird email client is vulnerable to an out-of-bounds read in the IMAP parsing component. A malicious mail server can send malformed strings with negative lengths, triggering the parser to read memory outside the buffer. If a mail server or connection is compromised, an attacker ...

CVE-2026-92238

A maliciously constructed mail header in Mozilla Thunderbird could cause multiple fields to be parsed as one or lead to memory safety violations . This vulnerability has been addressed in Thunderbird versions 156 , 140.16 , and 153.3 . For Debian users, the issue is resolved in versions 1:140.16....

CVE-2026-92240

Mozilla Thunderbird is vulnerable to an out-of-bounds read in its IMAP response parser. A malicious or compromised IMAP server can trigger this by sending an untagged ' ID' * response, which results in an application crash. The affected parsing path is reachable before authentication . Remediatio...

CVE-2026-100758

A sandbox escape vulnerability exists in the DOM: Navigation component affecting multiple versions of Firefox and Thunderbird . The flaw allows an attacker to escape the sandbox, with potential impacts involving high confidentiality, integrity, and availability. Remediation is available in Firefo...

CVE-2026-100759

A vulnerability exists in the Storage: Quota Manager component due to uninitialized memory . This issue can be exploited remotely to cause a denial of service . Affected products include Mozilla Thunderbird ESR (earlier than 153.4) and various versions of Firefox and Thunderbird . Remediation is ...

CVE-2026-84641

A malicious IMAP server can trigger a use-after-free and heap-memory disclosure in Mozilla Thunderbird by sending a crafted ID response. This vulnerability allows heap contents to be persisted to prefs.js . The issue was addressed in Thunderbird 155 , Thunderbird 140.15 , and Thunderbird 153.2 . ...

CVE-2026-100763

Mozilla Firefox and Thunderbird versions earlier than 157 are vulnerable to a heap buffer overflow due to incorrect boundary conditions in the Graphics: WebGPU component. An attacker could exploit this by inducing a user to open an email with a size of 2GB or greater. This vulnerability can lead ...

CVE-2026-100831

A use-after-free vulnerability exists in the DOM: UI Events & Focus Handling component of the Firefox browser. The flaw was addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation instances are provided in the documents.

CVE-2026-84637

In Mozilla Thunderbird , malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems. This technique allows attackers to bypass standard executable attachment protections and may display the attachment under a misleading filena...

CVE-2026-100764

The Firefox browser is affected by a privilege escalation vulnerability in the Graphics: WebGPU component. The root cause is identified as incorrect boundary conditions . This vulnerability was addressed and fixed in Firefox 157 . Exploitation details and specific attack vectors are not provided ...

CVE-2026-100830

A mitigation bypass vulnerability exists in the DOM: Navigation component of the Mozilla Firefox web browser. This flaw affects multiple versions including Firefox ESR , Thunderbird , and Firefox 157 . The issue has been addressed in the following patched versions: Firefox ESR 153.4 , Thunderbird...

CVE-2026-84642

Mozilla Thunderbird is affected by a vulnerability where the values of the mail.allowed_attachment_hostnames advanced configuration setting are used in a regular expression without proper escaping . This flaw could allow certain unintended hostnames to match the criteria, potentially enabling the...

CVE-2026-100757

A use-after-free vulnerability exists in the Widget component of the Firefox web browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Exploitation details are not provided in the documents, but the vulnerab...

CVE-2026-100765

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Firefox . This flaw was addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details are provided in the documents, but the vulnerability is reported to have a high impact .

CVE-2026-100825

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox web browser. This flaw can potentially lead to significant impacts on confidentiality, integrity, and availability. The issue has been addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit ...

CVE-2026-100766

A vulnerability in the Networking: JAR component of the Firefox web browser allows for information disclosure . This issue has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . The technical details regarding the specific...

CVE-2026-100822

A spoofing issue exists in the Networking: HTTP component of several Mozilla products. This vulnerability impacts Firefox ESR , Firefox , and Thunderbird . The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , Thunderbird 153.4 , and Thunderbird 157 . Specific details regarding the ro...

CVE-2026-100824

A privilege escalation vulnerability exists in the Places component of the Firefox browser. This flaw was addressed in the release of Firefox ESR 153.4 and Firefox 157 . Specific technical details regarding the root cause are not provided in the documentation. No information regarding active expl...

CVE-2026-100821

A site isolation issue exists in the Panning and Zooming component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in multiple releases, including Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 140.17 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17...

CVE-2026-100761

A use-after-free vulnerability in the Graphics: WebGPU component of Firefox allows for privilege escalation . This issue was resolved in Firefox 157 . While the specific technical root cause is not detailed in the provided documents, the impact is categorized as high . Information regarding activ...

CVE-2026-103500

Mozilla Thunderbird is vulnerable to a heap buffer overflow when a user opens an email that is greater than or equal to 2GB in size. This vulnerability was addressed in Thunderbird versions 157 , 140.17 , and 153.4 . Exploitation details are not provided in the available documents, but the issue ...

CVE-2026-100826

A Denial-of-service vulnerability exists in the Storage: StorageManager component of the Firefox browser. The issue was addressed in Firefox ESR 153.4 and Firefox 157 . No specific root cause or exploit details are provided in the documents, and no information regarding in-the-wild exploitation i...