Mozilla Thunderbird 140.13 Security Advisory: Multiple CVEs Fixed

Vulnerability Overview The Mozilla Foundation released Security Advisory 2026-72, addressing multiple security vulnerabilities in Thunderbird 140.13. These vulnerabilities include out-of-bounds reads, invalid pointers, site isolation issues, same-origin policy bypasses, boundary condition errors, use-after-free, sandbox escapes, JIT compilation errors, information leaks, and privilege escalation. Affected Scope Thunderbird 140.13: All users utilizing this version of Thunderbird. Specific Components: - MIME header parser - JavaScript: WebAssembly component - DOM: Navigation component - Audio/Video: cubeb component - WebRTC: Audio/Video component - DOM: Navigation component - Disability Access APIs component - JavaScript: WebAssembly component - DOM: Bindings (WebIDL) component - Graphics: ImageLib component - JavaScript: WebAssembly component - JavaScript Engine: JIT component - Disability Access APIs component - Graphics component - DOM: Navigation component - Framework component in DevTools - Networking: HTTP component - PDF Viewer component - DOM: Content Processes component - Graphics: WebRender component - Networking: DNS component - DOM: Networking component - Networking component - Enterprise Policies component - Storage: IndexedDB component - Audio/Video: GMP component - WebExtensions - Networking: WebSockets component Remediation Update Thunderbird: Users are advised to update to Thunderbird 140.13 immediately to fix all the aforementioned vulnerabilities. Specific Fixes: - CVE-2026-14899: Fixes an out-of-bounds read in the MIME header parser. - CVE-2026-15718: Fixes an invalid pointer in the JavaScript: WebAssembly component. - CVE-2026-15719: Fixes a site isolation issue in the DOM: Navigation component. - CVE-2026-16349: Fixes a same-origin policy bypass in the DOM: Navigation component. - CVE-2026-16350: Fixes a boundary condition error in the Audio/Video: cubeb component. - CVE-2026-16362: Fixes a use-after-free in the WebRTC: Audio/Video component. - CVE-2026-16351: Fixes a sandbox escape in the DOM: Navigation component. - CVE-2026-16352: Fixes a use-after-free in the Disability Access APIs component. - CVE-2026-16363: Fixes a JIT compilation error in the JavaScript: WebAssembly component. - CVE-2026-16353: Fixes an invalid pointer in the DOM: Bindings (WebIDL) component. - CVE-2026-16354: Fixes an information leak in the Graphics: ImageLib component. - CVE-2026-16368: Fixes a boundary condition error in the JavaScript: WebAssembly component. - CVE-2026-16369: Fixes an integer overflow in the JavaScript: WebAssembly component. - CVE-2026-16355: Fixes a JIT compilation error in the JavaScript Engine: JIT component. - CVE-2026-16356: Fixes a use-after-free in the Disability Access APIs component. - CVE-2026-16357: Fixes a boundary condition error in the Graphics component. - CVE-2026-16371: Fixes a privilege escalation in the DOM: Navigation component. - CVE-2026-16374: Fixes an information leak in the Framework component in DevTools. - CVE-2026-16375: Fixes a site isolation issue in the Networking: HTTP component. - CVE-2026-16377: Fixes a mitigation bypass in the PDF Viewer component. - CVE-2026-16379: Fixes a privilege escalation in the DOM: Content Processes component. - CVE-2026-16358: Fixes a site isolation issue in the Graphics: WebRender component. - CVE-2026-16381: Fixes a same-origin policy bypass in the Networking: DNS component. - CVE-2026-16383: Fixes a mitigation bypass in the DOM: Networking component. - CVE-2026-16387: Fixes a site isolation issue in the Networking component. - CVE-2026-16390: Fixes a mitigation bypass in the Enterprise Policies component. - CVE-2026-16391: Fixes an information leak in the Storage: IndexedDB component. - CVE-2026-16359: Fixes a boundary condition error in the Audio/Video: GMP component. - CVE-2026-16396: Fixes a privilege escalation in WebExtensions. - CVE-2026-16405: Fixes an information leak in the Networking: WebSockets component. POC Code or Exploit Code No specific POC code or exploit code is provided in the page. --- Summary: The Mozilla Foundation released Security Advisory 2026-72, addressing multiple security vulnerabilities in Thunderbird 140.13. Users are advised to update to the latest version immediately to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird 140.13 Security Advisory: Multiple CVEs Fixed