Mozilla Thunderbird 153 Security Advisory: Multiple Vulnerabilities Including Sandbox Escape and Privilege Escalation

Vulnerability Overview The Mozilla Foundation has released Security Advisory 2026-71, concerning multiple security vulnerabilities in Thunderbird version 153. These vulnerabilities include out-of-bounds reads, same-origin policy bypasses, boundary condition errors, use-after-free vulnerabilities, sandbox escapes, JIT miscompilations, privilege escalation, invalid pointers, information disclosure, integer overflows, and mitigation bypasses. Affected Scope Thunderbird 153: All users running this version of Thunderbird may be affected. Specific Components: The vulnerabilities involve multiple components, including the MIME header parser, DOM Navigation component, Audio/Video component, WebRTC, JavaScript: WebAssembly, Graphics component, PDF viewer, and Networking component, among others. Remediation Update Thunderbird: Users are advised to update to the latest version of Thunderbird as soon as possible to patch these vulnerabilities. Specific Fixes: Each vulnerability has a corresponding Bug ID, and developers have applied fixes for these issues. Vulnerability Details CVE-2026-14899: Off-by-one out of bounds read in MIME header parser for forwarding Reporter: Claude, Kai Engert Impact: Moderate Description: An out-of-bounds read exists in the MIME header parser when forwarding messages, which could potentially lead to a crash. References: Bug 2046137 CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component Reporter: Tran Quac Impact: High References: Bug 2034682 CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component Reporter: Tomoya Nakanishi Impact: High References: Bug 2042833 CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component Reporter: crixer Impact: High References: Bug 2043188 CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component Reporter: Yaqoub Aldurayhim Impact: High References: Bug 2045468 CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component Reporter: Oskar L Impact: High References: Bug 2046410 CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component Reporter: Nebula Security Impact: High References: Bug 2047689 CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback component Reporter: stevej Impact: High References: Bug 2047882 CVE-2026-16365: Privilege escalation in the DOM: Workers component Reporter: Khanh Nguyen Impact: High References: Bug 2049149 CVE-2026-16366: Privilege escalation in the DOM: Navigation component Reporter: Khanh Nguyen Impact: High References: Bug 2049181 CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component Reporter: fedek Impact: High References: Bug 2049523 CVE-2026-16354: Information disclosure in the Graphics: ImageLib component Reporter: satyamasd Impact: High References: Bug 2050626 CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component Reporter: Oskar L Impact: High References: Bug 2050627 CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component Reporter: Nebula Security Impact: High References: Bug 2051015 CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2051854 CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2052207 CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component Reporter: Oskar L Impact: High References: Bug 2052562 CVE-2026-16357: Incorrect boundary conditions in the Graphics component Reporter: Sup3rh3i Impact: High References: Bug 2053320 CVE-2026-16370: Mitigation bypass in the DOM: Networking component Reporter: tiebuchan Impact: Moderate References: Bug 1996495 CVE-2026-16371: Privilege escalation in the DOM: Navigation component Reporter: stevej Impact: Moderate References: Bug 2008389 CVE-2026-16372: Privilege escalation in the DOM: Content Processes component Reporter: Sajeeb Lohani Impact: Moderate References: Bug 2013800 CVE-2026-16374: Information disclosure in the Framework component in DevTools Reporter: Tomoya Nakanishi Impact: Moderate References: Bug 2027510 CVE-2026-16375: Site isolation issue in the Networking: HTTP component Reporter: pakhunov.anton.n Impact: Moderate References: Bug 2032140 CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component Reporter: Miikalis Haatainen Impact: Moderate References: Bug 2035733 CVE-2026-16377: Mitigation bypass in the PDF Viewer component Reporter: Nikola Kojc Impact: Moderate References: Bug 2037778 CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop component Reporter: Farhad Sajid Barbhuiya Impact: Moderate References: Bug 2038808 CVE-2026-16379: Privilege escalation in the DOM: Content Processes component Reporter: Shu Takahashi Impact: Moderate References: Bug 2039452 CVE-2026-16358: Site isolation issu

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird 153 Security Advisory: Multiple Vulnerabilities Including Sandbox Escape and Privilege Escalation