Mozilla Thunderbird 2026-51 Security Advisory Vulnerability Summary

Mozilla Thunderbird Security Vulnerability Summary Vulnerability Overview The Mozilla Foundation released security advisory 2026-51, addressing multiple security vulnerabilities in Thunderbird version 140.11. These vulnerabilities primarily involve boundary condition errors, use-after-free issues, integer overflows, privilege escalation, and sandbox escapes. Scope of Impact Affected Product: Thunderbird 140.11 Advisory Date: May 19, 2026 Severity Levels: - High: CVE-2026-8946, CVE-2026-8388, CVE-2026-8947, CVE-2026-8391, CVE-2026-8401, CVE-2026-8975 - Moderate: CVE-2026-8949, CVE-2026-8950, CVE-2026-8953, CVE-2026-8954, CVE-2026-8955, CVE-2026-8956, CVE-2026-8957, CVE-2026-8958, CVE-2026-8959, CVE-2026-8974 - Low: CVE-2026-8961, CVE-2026-8962, CVE-2026-8968, CVE-2026-8970 Remediation Update Version: Upgrade to Thunderbird 140.11 or later Specific Fixes: - Resolved security vulnerabilities across multiple components, including Audio/Video, JavaScript Engine, DOM, Widget, Networking, and Security. - Fixed memory safety bugs that could potentially lead to arbitrary code execution. - Addressed security issues such as privilege escalation, sandbox escape, and information disclosure. Detailed Vulnerability List High Severity Vulnerabilities 1. CVE-2026-8946: Audio/Video: Boundary condition error in the Web Codecs component 2. CVE-2026-8388: JavaScript Engine: Boundary condition error in the JIT component 3. CVE-2026-8947: DOM: Use-after-free vulnerability in the Bindings (WebIDL) component 4. CVE-2026-8391: JavaScript Engine: Other issues within the component 5. CVE-2026-8401: Sandbox escape in the Profile Backup component 6. CVE-2026-8975: Memory safety vulnerabilities in Thunderbird 140.11 and 151 Moderate Severity Vulnerabilities 1. CVE-2026-8949: Widget: Integer overflow in the Win32 component 2. CVE-2026-8950: Networking: Same-origin policy bypass in the HTTP component 3. CVE-2026-8953: Sandbox escape in the Disability Access APIs component 4. CVE-2026-8954: Audio/Video: Boundary condition error and integer overflow in the component 5. CVE-2026-8955: DOM: Privilege escalation in the Workers component 6. CVE-2026-8956: Networking: Integer overflow in the JAR component 7. CVE-2026-8957: Enterprise Policies: Privilege escalation in the component 8. CVE-2026-8958: Security: Information disclosure and sandbox escape in the Process Sandboxing component 9. CVE-2026-8959: Widget: Sandbox escape in the Win32 component 10. CVE-2026-8974: Memory safety vulnerabilities in Thunderbird 140.11 and 151 Low Severity Vulnerabilities 1. CVE-2026-8961: Phishing issue in the Form Autofill component 2. CVE-2026-8962: DOM: Bypass of security mitigation measures in the Security component 3. CVE-2026-8968: Audio/Video: Denial of Service (DoS) vulnerability in the Web Codecs component 4. CVE-2026-8970: Security: Privilege escalation in the Security component Notes These vulnerabilities may be exploitable when using Thunderbird via email, as scripts are disabled when reading emails. However, potential risks may exist in browser or browser-like environments. All vulnerabilities have been resolved by upgrading to Thunderbird 140.11 or later.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird 2026-51 Security Advisory Vulnerability Summary