Vulnerability

CERT-In Vulnerability Note CIVN-2026-0045
Multiple Vulnerabilities in Mozilla Thunderbird

Original Issue Date:January 23, 2026

Severity Rating: HIGH

Software Affected

Mozilla Thunderbird ESR versions prior to 140.7
Mozilla Thunderbird versions prior to 147

Overview

Multiple vulnerabilities have been reported in Mozilla Thunderbird which could allow a remote attacker to exe-cute arbitrary code, bypass security restrictions or perform spoofing attacks on the targeted system.

Target Audience
All end-user organizations and individuals using Mozilla Thunderbird.

Risk Assessment
High risk of system compromise and service disruptions.

Impact Assessment
Potential for system compromise and service unavailability.

Description

These vulnerabilities exist in Mozilla Thunderbird due to Mitigation bypass in the DOM: Security component; Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component, integer overflow in the Graphics component; Use-after-free in the IPC component, JavaScript Engine component, Ja-vaScript: GC component; Spoofing issue in the Downloads Panel component, Information disclosure in the Networking component, XML component; Clickjacking issue, information disclosure in the PDF Viewer component; Spoofing issue in the DOM: Copy & Paste and Drag & Drop component; Memory safety bugs and Denial-of-service in the DOM: Service Workers component. A remote attacker could exploit these vulnerabilities by convincing the victim to open a specially crafted web request.

Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code, bypass security restrictions or perform spoofing attacks on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/

https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/

References

Mozilla
https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/
https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/

CVE Name
CVE-2025-14327
CVE-2026-0877
CVE-2026-0878
CVE-2026-0879
CVE-2026-0880
CVE-2026-0880
CVE-2026-0882
CVE-2026-0883
CVE-2026-0884
CVE-2026-0885
CVE-2026-0886
CVE-2026-0887
CVE-2026-0888
CVE-2026-0889
CVE-2026-0890
CVE-2026-0890
CVE-2026-0892

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India