Mozilla Thunderbird Multiple CVE Security Advisory

Vulnerability Overview The Mozilla Foundation released security advisory 2026-79 to address multiple security vulnerabilities in Thunderbird 140.14. These vulnerabilities include: 1. CVE-2026-74934: Graphics: Site isolation issues in the CanvasWebGL component. 2. CVE-2026-74935: DOM: Privilege escalation in the Networking component. 3. CVE-2026-74936: JavaScript: Use-after-free issues in the WebAssembly component. 4. CVE-2026-74939: DOM: Privilege escalation in the Navigation component. 5. CVE-2026-74940: Graphics: Use-after-free issues in the Text component. 6. CVE-2026-74941: Graphics: Privilege escalation in the CanvasWebGL component. 7. CVE-2026-74942: Privilege escalation in the Remote Settings Client component. 8. CVE-2026-74943: Graphics: Use-after-free issues in the ImageLib component. 9. CVE-2026-74944: DOM: Use-after-free issues in the Core & HTML component. 10. CVE-2026-74945: Graphics: Information disclosure in the Text component. 11. CVE-2026-74946: Graphics: Privilege escalation in the CanvasWebGL component due to incorrect boundary conditions. 12. CVE-2026-74948: Graphics: Information disclosure. 13. CVE-2026-74949: Graphics: Privilege escalation in the Canvas2D component due to use-after-free issues. 14. CVE-2026-74953: Networking: Privilege escalation in the Cookies component. 15. CVE-2026-74957: Safe Browsing: Mitigation bypass. 16. CVE-2026-74959: Storage: Mitigation bypass in the Cache API component. 17. CVE-2026-74960: WebExtensions: Site isolation issues. 18. CVE-2026-74962: Networking: Site isolation issues in the Cookies component. 19. CVE-2026-74963: Networking: Same-Origin Policy (SOP) bypass in the Cookies component. 20. CVE-2026-74964: Graphics: Integer overflow. 21. CVE-2026-74965: Shell Integration: Privilege escalation. 22. CVE-2026-74967: Audio/Video: Same-Origin Policy (SOP) bypass in the Playback component. 23. CVE-2026-74969: Layout: Use-after-free issues in the Text and Fonts component. 24. CVE-2026-74971: DOM: Information disclosure in the UI Events & Focus Handling component. 25. CVE-2026-74972: DOM: Information disclosure in the Push Subscriptions component. 26. CVE-2026-74973: Graphics: Race conditions and use-after-free issues. 27. CVE-2026-74974: Graphics: Same-Origin Policy (SOP) bypass in the ImageLib component. 28. CVE-2026-74976: JavaScript Engine: JIT compilation errors in the JIT component. 29. CVE-2026-74983: Data Loss Prevention: Mitigation bypass. 30. CVE-2026-74987: Internally discovered vulnerability, fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1, and Thunderbird 154. Impact Scope These vulnerabilities primarily affect Thunderbird 140.14 and related versions (Thunderbird ESR 140.14, Thunderbird ESR 153.1, and Thunderbird 154). The severity of the vulnerabilities ranges from low to high, with some potentially leading to privilege escalation, information disclosure, or use-after-free issues, posing threats to user privacy and system security. Remediation Mozilla has released Thunderbird 140.14, which addresses all the aforementioned security vulnerabilities. Users are advised to upgrade to the latest version as soon as possible to ensure security. Specific remediation measures include: Fixed vulnerabilities in components such as CanvasWebGL, WebAssembly, Navigation, Text, ImageLib, Core & HTML, Cookies, Safe Browsing, Cache API, WebExtensions, Shell Integration, Playback, Text and Fonts, UI Events & Focus Handling, Push Subscriptions, and JIT. Resolved issues related to privilege escalation, information disclosure, use-after-free, Same-Origin Policy (SOP) bypass, integer overflow, race conditions, and JIT compilation errors. Addressed mitigation bypass issues to enhance overall system security. POC Code or Exploit Code No specific POC (Proof of Concept) code or exploit code was provided in the advisory. --- Summary: Mozilla has released Thunderbird 140.14 to fix multiple security vulnerabilities. Users should upgrade promptly to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird Multiple CVE Security Advisory