Mozilla Thunderbird 154 Security Advisory: Multiple CVEs including UAF, Privilege Escalation, and Site Isolation Bypass

Vulnerability Overview The Mozilla Foundation has released security advisory 2026-78, addressing multiple security vulnerabilities in Thunderbird 154. These vulnerabilities include sandbox escape, site isolation issues, privilege escalation, use-after-free, information disclosure, and more. Affected Scope Thunderbird 154: All users utilizing this version of Thunderbird may be affected. Specific Components: The vulnerabilities involve multiple components, such as Remote Settings Client, Graphics: CanvasWebGL, Networking, JavaScript: WebAssembly, JavaScript: GC, Graphics: Text, Graphics: ImageLib, DOM: Core & HTML, Downloads API, Application Update, Networking: Cookies, Storage: Cache API, Request Handling, Service Workers, Safe Browsing, WebRTC, Storage: Cache API, WebExtensions, Web Audio, etc. Remediation Update Thunderbird: Users are advised to update to the latest version of Thunderbird immediately to fix these vulnerabilities. Specific Remediation Measures: Each vulnerability has specific fixes, such as resolving sandbox escapes, site isolation issues, privilege escalation, use-after-free, etc. Vulnerability Details CVE-2026-74934: Site Isolation Issue in Graphics: CanvasWebGL Component Reporter: satyamad Impact: High References: Bug 2050594 CVE-2026-74935: Privilege Escalation in Networking Component Reporter: Yaqoub Aldurayhim Impact: High References: Bug 2051013 CVE-2026-74936: Use-after-free in JavaScript: WebAssembly Component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2052688 CVE-2026-74937: Use-after-free in JavaScript: GC Component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2053337 CVE-2026-74938: Mitigation Bypass in JavaScript: GC Component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2053688 CVE-2026-74939: Privilege Escalation in DOM: Navigation Component Reporter: choeseyeong Impact: High References: Bug 2054416 CVE-2026-74940: Use-after-free in Graphics: Text Component Reporter: kiyong Impact: High References: Bug 2054842 CVE-2026-74941: Privilege Escalation in Graphics: CanvasWebGL Component Reporter: Jacolon Walker Impact: High References: Bug 2055056 CVE-2026-74942: Privilege Escalation in Remote Settings Client Component Reporter: Gal Ankonina Impact: High References: Bug 2056571 CVE-2026-74943: Use-after-free in Graphics: ImageLib Component Reporter: Abdulaziz Alasalqah Impact: High References: Bug 2057308 CVE-2026-74944: Use-after-free in DOM: Core & HTML Component Reporter: Amy Burnett of OpenAI Impact: High References: Bug 2057778 CVE-2026-74945: Information Disclosure in Graphics: Text Component Reporter: Abdulaziz Alasalqah Impact: High References: Bug 2057808 CVE-2026-74946: Privilege Escalation Due to Incorrect Boundary Conditions in Graphics: CanvasWebGL Component Reporter: locust1b Impact: High References: Bug 2059997 CVE-2026-74947: Privilege Escalation Due to Invalid Pointers in Graphics Component Reporter: navapon Impact: High References: Bug 2060010 CVE-2026-74948: Information Disclosure in Graphics Component Reporter: Yaqoub Aldurayhim Impact: High References: Bug 2060106 CVE-2026-74949: Privilege Escalation Due to Use-after-free in Graphics: Canvas2D Component Reporter: r00tdaddy Impact: High References: Bug 2060245 CVE-2026-74950: Privilege Escalation in Downloads API Component Reporter: Frederik Braun Impact: Moderate References: Bug 1889253 CVE-2026-74952: Privilege Escalation in Application Update Component Reporter: Tomoya Nakanishi Impact: Moderate References: Bug 2021757 CVE-2026-74953: Privilege Escalation in Networking: Cookies Component Reporter: Satoshi Tsuji Impact: Moderate References: Bug 2022382 CVE-2026-74954: Information Disclosure Due to Side-Channel in Storage: Cache API Component Reporter: Tomoya Nakanishi Impact: Moderate References: Bug 2025732 CVE-2026-74955: Privilege Escalation in Request Handling Component Reporter: jmwebdevelopment Impact: Moderate References: Bug 2029205 CVE-2026-74956: Same-Origin Policy Bypass in DOM: Service Workers Component Reporter: pakhunov.anton.n Impact: Moderate References: Bug 2032406 CVE-2026-74957: Mitigation Bypass in Safe Browsing Component Reporter: Tomoya Nakanishi Impact: Moderate References: Bug 2041906 CVE-2026-74958: Information Disclosure in WebRTC Component Reporter: Tomoya Nakanishi Impact: Moderate References: Bug 2045388 CVE-2026-74959: Mitigation Bypass in Storage: Cache API Component Reporter: David Bors at Snyk Security Labs Impact: Moderate References: Bug 2047853 CVE-2026-74960: Site Isolation Issue in WebExtensions Component Reporter: Khanh Nguyen Impact: Moderate References: Bug 2049148 CVE-2026-74961: Side-Channel in Web Audio Component Reporter: Rintaro Kawasugi Impact: Moderate References: Bug 2050388 CVE-2026-74962: Site Isolation Issue in Networking: Cookies Component Reporter: Yaqoub Aldurayhim Impact: Moderate References: Bug 2050425 CVE-2026-74963: Same-Origin Policy Bypass in Networking: Cookies Component Reporter: 5up3rh3i Impact: M

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird 154 Security Advisory: Multiple CVEs including UAF, Privilege Escalation, and Site Isolation Bypass