Multiple vulnerabilities in Mozilla Thunderbird

Description

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in the DOM: Core & HTML component can be exploited remotely to execute arbitrary code.
2. A remote code execution vulnerability in the WebRTC component can be exploited remotely to execute arbitrary code.
3. Denial of service vulnerability in the Audio/Video: Web Codecs component can be exploited remotely to cause denial of service.
4. Information disclosure vulnerability in the Graphics: Canvas2D component can be exploited to obtain sensitive information.
5. Security vulnerability in the Graphics: WebRender component can be exploited to bypass security restrictions.
6. Denial of service vulnerability in the WebRTC component can be exploited remotely to cause denial of service.
7. A remote code execution vulnerability in the JavaScript Engine component can be exploited remotely to execute arbitrary code.
8. Security vulnerability in the DOM: postMessage component can be exploited to bypass security restrictions.
9. Denial of service vulnerability in the JavaScript: WebAssembly component can be exploited remotely to cause denial of service.
10. A remote code execution vulnerability in the JavaScript: WebAssembly component can be exploited remotely to execute arbitrary code.
11. A remote code execution vulnerability in the Widget: Cocoa component can be exploited remotely to execute arbitrary code.
12. Security vulnerability in the Networking: Cookies component can be exploited to bypass security restrictions.
13. Security vulnerability in the Networking component can be exploited to bypass security restrictions.
14. Security UI vulnerability in the DOM: Core & HTML component can be exploited to spoof user interface.
15. Security vulnerability in the File Handling component can be exploited to bypass security restrictions.
16. Denial of service vulnerability in the DOM: Device Interfaces component can be exploited remotely to cause denial of service.
17. Information disclosure vulnerability in the Form Autofill component can be exploited to obtain sensitive information.
18. Denial of service vulnerability in the Libraries component in NSS can be exploited remotely to cause denial of service.
19. Security vulnerability in the Debugger component can be exploited to bypass security restrictions.
20. Denial of service vulnerability in the Storage: IndexedDB component can be exploited remotely to cause denial of service.
21. Security vulnerability in the DOM: Security component can be exploited to bypass security restrictions.
22. A remote code execution vulnerability in the Graphics: WebGPU component can be exploited remotely to execute arbitrary code.
23. Denial of service vulnerability in the WebRTC: Networking component can be exploited remotely to cause denial of service.
24. Denial of service vulnerability in the Networking: DNS component can be exploited remotely to cause denial of service.
25. Denial of service vulnerability in the Audio/Video: Playback component can be exploited remotely to cause denial of service.
26. Denial of service vulnerability in the JavaScript Engine component can be exploited remotely to cause denial of service.
27. Information disclosure vulnerability in the IP Protection component can be exploited to obtain sensitive information.
28. A remote code execution vulnerability in the Audio/Video: Playback component can be exploited remotely to execute arbitrary code.
29. A remote code execution vulnerability in Firefox 150 and Thunderbird 150 can be exploited remotely to execute arbitrary code.
30. A remote code execution vulnerability in Firefox ESR 115 can be exploited remotely to execute arbitrary code.
31. A remote code execution vulnerability in Firefox ESR 140 can be exploited remotely to execute arbitrary code.

Original advisories

• MFSA2026-33

Exploitation

Related products

• Mozilla-Thunderbird

CVE list

• CVE-2026-6746
  critical
• CVE-2026-6747
  critical
• CVE-2026-6748
  critical
• CVE-2026-6749
  critical
• CVE-2026-6750
  critical
• CVE-2026-6751
  high
• CVE-2026-6752
  high
• CVE-2026-6753
  unknown
• CVE-2026-6754
  critical
• CVE-2026-6755
  high
• CVE-2026-6757
  unknown
• CVE-2026-6758
  critical
• CVE-2026-6759
  critical
• CVE-2026-6760
  unknown
• CVE-2026-6761
  critical
• CVE-2026-6762
  unknown
• CVE-2026-6763
  high
• CVE-2026-6764
  high
• CVE-2026-6765
  high
• CVE-2026-6766
  critical
• CVE-2026-6767
  high
• CVE-2026-6768
  critical
• CVE-2026-6769
  critical
• CVE-2026-6770
  high
• CVE-2026-6771
  critical
• CVE-2026-6772
  critical
• CVE-2026-6773
  critical
• CVE-2026-6774
  high
• CVE-2026-6775
  high
• CVE-2026-6776
  critical
• CVE-2026-6777
  high
• CVE-2026-6778
  high
• CVE-2026-6779
  high
• CVE-2026-6780
  critical
• CVE-2026-6781
  critical
• CVE-2026-6782
  critical
• CVE-2026-6783
  high
• CVE-2026-6784
  critical
• CVE-2026-6785
  unknown
• CVE-2026-6786
  unknown

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com