Mozilla Foundation Security Advisory 2026-96

Security Vulnerabilities fixed in Thunderbird 153.3

Announced

September 16, 2026

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 153.3

Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-92238: Ambiguous parsing of mail headers

Reporter: Ramesh Adhikari, Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)
Impact: medium

Description

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations.

References

Bug 2060601

#CVE-2026-92239: Buffer overrun in IMAP

Reporter: Ramesh Adhikari, Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)
Impact: medium

Description

A maliciously constructed IMAP line could cause an out-of-bounds buffer read.

References

Bug 2060488

#CVE-2026-92240: Out-of-bounds read in IMAP response parser

Reporter: Ahmed Albalawi
Impact: low

Description

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.

References

Bug 2069113

#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component

Reporter: [email protected]
Impact: high

References

Bug 2056051

#CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2057121

#CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058064

#CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058065

#CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058066

#CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058067

#CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058068

#CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058069

#CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: high

References

Bug 2058078

#CVE-2026-92015: Privilege escalation in the WebExtensions component

Reporter: Quy Pham
Impact: high

References

Bug 2060235

#CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2061245

#CVE-2026-92016: Use-after-free in the Disability Access APIs component

Reporter: Mozilla
Impact: high

References

Bug 2061327

#CVE-2026-92017: Privilege escalation in the DOM: Service Workers component

Reporter: Mozilla
Impact: high

References

Bug 2061777

#CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component

Reporter: Quy Pham
Impact: high

References

Bug 2064287

#CVE-2026-92019: Mitigation bypass in the Remote Settings Client component

Reporter: Shu Takahashi
Impact: high

References

Bug 2065636

#CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

Reporter: Rintaro Kawasugi
Impact: high

References

Bug 2066329

#CVE-2026-92022: Use-after-free in the DOM: HTML Parser component

Reporter: Seohyeon Maeng
Impact: high

References

Bug 2068059

#CVE-2026-92023: Use-after-free in the XML component

Reporter: Mozilla
Impact: high

References

Bug 2068342

#CVE-2026-92024: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2068354

#CVE-2026-92025: Use-after-free in the DOM: Navigation component

Reporter: Mozilla
Impact: high

References

Bug 2068361

#CVE-2026-92026: Use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2068378

#CVE-2026-92027: Use-after-free in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2068433

#CVE-2026-92028: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068440

#CVE-2026-92029: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2068445

#CVE-2026-92038: Mitigation bypass in the Remote Settings Client component

Reporter: Mozilla
Impact: high

References

Bug 2068952

#CVE-2026-92039: Mitigation bypass in the DOM: Notifications component

Reporter: tiebuchen
Impact: moderate

References

Bug 2001265

#CVE-2026-92041: Mitigation bypass in the DOM: Networking component

Reporter: Atsushi Sada
Impact: moderate

References

Bug 2029482

#CVE-2026-92042: Race condition in the DOM: Content Processes component

Reporter: Mozilla
Impact: moderate

References

Bug 2049342

#CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component

Reporter: Mozilla
Impact: moderate

References

Bug 2050150

#CVE-2026-92044: Information disclosure in the Networking: HTTP component

Reporter: Gee-netics
Impact: moderate

References

Bug 2051466

#CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component

Reporter: Mozilla
Impact: moderate

References

Bug 2054622

#CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

Reporter: anas cherni
Impact: moderate

References

Bug 2058417

#CVE-2026-92046: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2058618

#CVE-2026-92047: Privilege escalation in the Crash Reporting component

Reporter: Mozilla
Impact: moderate

References

Bug 2059021

#CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: moderate

References

Bug 2061235

#CVE-2026-92049: Use-after-free in the Widget: Win32 component

Reporter: Mozilla
Impact: moderate

References

Bug 2061295

#CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: moderate

References

Bug 2061499

#CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: moderate

References

Bug 2061503

#CVE-2026-92054: Privilege escalation in the Memory component

Reporter: Amy Burnett of OpenAI
Impact: moderate

References

Bug 2062551

#CVE-2026-92055: Privilege escalation in the DevTools component

Reporter: Finn Westendorf
Impact: moderate

References

Bug 2063652

#CVE-2026-92056: Use-after-free in the Graphics: Text component

Reporter: r00tdaddy
Impact: moderate

References

Bug 2065346

#CVE-2026-92057: Mitigation bypass in the Enterprise Policies component

Reporter: Shu Takahashi
Impact: moderate

References

Bug 2065646

#CVE-2026-92031: Information disclosure in the Graphics: ImageLib component

Reporter: Qi Qin
Impact: moderate

References

Bug 2067971

#CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2068437

#CVE-2026-92058: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2068438

#CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component

Reporter: Mozilla
Impact: moderate

References

Bug 2068442

#CVE-2026-92060: Use-after-free in the Internationalization component

Reporter: Mozilla
Impact: low

References

Bug 2027336

#CVE-2026-92062: Privilege escalation in the Session Restore component

Reporter: Mozilla
Impact: low

References

Bug 2054670

#CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: low

References

Bug 2057990

#CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: low

References

Bug 2058018

#CVE-2026-92067: Use-after-free in the Widget: Gtk component

Reporter: Mozilla
Impact: low

References

Bug 2058664

#CVE-2026-92068: Site isolation issue in the Reader Mode component

Reporter: Mozilla
Impact: low

References

Bug 2058790

#CVE-2026-92069: Spoofing issue in the DOM: Navigation component

Reporter: Mozilla
Impact: low

References

Bug 2059196

#CVE-2026-92070: Information disclosure in the Networking component

Reporter: Mohamed Mbarek
Impact: low

References

Bug 2060220

#CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: low

References

Bug 2061231

#CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component

Reporter: Mozilla
Impact: low

References

Bug 2061257

#CVE-2026-92073: Privilege escalation in the Enterprise Policies component

Reporter: Tyler Maclachlan
Impact: low

References

Bug 2062527

#CVE-2026-92074: Mitigation bypass in the Popup Blocker component

Reporter: Finn Westendorf
Impact: low

References

Bug 2063539

#CVE-2026-92075: Mitigation bypass in the Networking component

Reporter: Takeshi Kaneko
Impact: low

References

Bug 2063814

#CVE-2026-92076: Incorrect boundary conditions in the Networking component

Reporter: Mozilla
Impact: low

References

Bug 2064026

#CVE-2026-92077: Denial-of-service in the SVG component

Reporter: sak
Impact: low

References

Bug 2064601

#CVE-2026-92078: Denial-of-service in the Security component

Reporter: Dominik Bay
Impact: low

References

Bug 2066736

#CVE-2026-92079: Mitigation bypass in the Widget: Win32 component

Reporter: barbarossa404
Impact: low

References

Bug 2067531