Mozilla Security Advisory 2026-61: Firefox/Thunderbird Patch for Multiple CVEs

Vulnerability Overview Mozilla Foundation has released security advisory 2026-61, addressing multiple security vulnerabilities in Thunderbird 140.12. These vulnerabilities include privilege escalation, memory safety errors, use-after-free, sandbox escape, Just-In-Time (JIT) miscompilation, cross-origin policy bypass, information disclosure, and denial of service. Affected Versions Thunderbird 140.12 Firefox ESR 140.12 Firefox 152 Thunderbird ESR 140.12 Thunderbird 152 Resolution All listed vulnerabilities have been fixed in the aforementioned versions. Users should upgrade to the latest version to resolve these security issues. Vulnerability Details CVE-2026-12289: Privilege Escalation in Graphics: WebRender Component Reporter: choeseyeong Impact: High CVE-2026-12290: Memory Safety Error in Thunderbird ESR 140.12 Reporter: jayjayjazz Impact: High CVE-2026-12291: Use-After-Free in Networking: HTTP Component Reporter: Zijie Zhao Impact: High CVE-2026-12292: Boundary Condition Error in Web Audio Component Reporter: Zijie Zhao Impact: High CVE-2026-12294: Sandbox Escape in DOM: Workers Component Reporter: Quy Pham Impact: High CVE-2026-12295: Sandbox Escape in DOM: Navigation Component Reporter: Yaqoub Aldurayhim Impact: High CVE-2026-12298: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Haruka Yamazaki Impact: High CVE-2026-12296: Sandbox Escape in Security: Process Sandboxing Component Reporter: Yaqoub Aldurayhim Impact: High CVE-2026-12297: Sandbox Escape in Networking Component Due to Boundary Condition Error Reporter: ZX Impact: High CVE-2026-12299: JIT Miscompilation in DOM: Core & HTML Component Reporter: Hyeonjun Ahn Impact: High CVE-2026-12329: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Michael Froman Impact: High CVE-2026-12302: Mitigation Bypass in DOM: Security Component Reporter: lebronli Impact: Medium CVE-2026-12304: Same-Origin Policy Bypass in Networking: Cookies Component Reporter: Yaqoub Aldurayhim Impact: Medium CVE-2026-12305: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Zijie Zhao Impact: Medium CVE-2026-12306: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Mihalis Haatainen Impact: Medium CVE-2026-12307: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Atsushi Sada Impact: Medium CVE-2026-12308: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Mihalis Haatainen Impact: Medium CVE-2026-12309: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Yaqoub Aldurayhim Impact: Medium CVE-2026-12310: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Carl Pearson Impact: Medium CVE-2026-12311: Information Disclosure and Sandbox Escape in Security: Process Sandboxing Component Reporter: Yaqoub Aldurayhim Impact: Medium CVE-2026-12312: Memory Safety Error in Thunderbird ESR 140.12 Reporter: Rintaro Kawasugi Impact: Medium CVE-2026-12313: Information Disclosure and Sandbox Escape in Security: Process Sandboxing Component Reporter: evyatar Impact: Medium CVE-2026-12314: Memory Safety Error in Thunderbird ESR 140.12 Reporter: satyamasd Impact: Medium CVE-2026-12315: Mitigation Bypass in DOM: Security Component Reporter: Nguyen Minh Impact: Medium CVE-2026-12330: Boundary Condition Error in Internationalization Component Reporter: Mozilla Fuzzing Team Impact: Medium CVE-2026-12324: Boundary Condition Error in Graphics: CanvasWebGL Component Reporter: Mihalis Haatainen Impact: Low CVE-2026-12325: Denial of Service in Graphics: ImageLib Component Reporter: SecurIn Impact: Low CVE-2026-12327: Memory Safety Errors in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152, and Thunderbird 152 Reporter: Christian Holler, Jens Stutte, Nika Layzell, Randell Jesup, Tom Schuster, and Mozilla Fuzzing Team Impact: Medium CVE-2026-12328: Memory Safety Errors in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152, and Thunderbird 152 Reporter: Andrew McCreight, Randell Jesup, Tom Ritter, and Mozilla Fuzzing Team Impact: High Notes These vulnerabilities cannot be exploited via email within the Thunderbird product, as scripts are disabled when reading emails. However, risks may exist in browsers or browser-like environments. Code Blocks No Proof of Concept (PoC) code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Security Advisory 2026-61: Firefox/Thunderbird Patch for Multiple CVEs