Mozilla Foundation Security Advisory 2026-101

Security Vulnerabilities fixed in Thunderbird 157

Announced

September 30, 2026

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 157

Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-103500: Heap buffer overflow opening large email

Reporter: Ahmed Albalawi <[email protected]>
Impact: low

Description

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.

References

Bug 2070267

#CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component

Reporter: Mozilla
Impact: high

References

Bug 2047721

#CVE-2026-100757: Use-after-free in the Widget component

Reporter: Mohamed Mbarek
Impact: high

References

Bug 2049352

#CVE-2026-100758: Sandbox escape in the DOM: Navigation component

Reporter: Mozilla
Impact: high

References

Bug 2049792

#CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component

Reporter: Mozilla
Impact: high

References

Bug 2054736

#CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component

Reporter: Mozilla
Impact: high

References

Bug 2058017

#CVE-2026-100761: Privilege escalation due to use-after-free in the Graphics: WebGPU component

Reporter: Mozilla
Impact: high

References

Bug 2059020

#CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2059404

#CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU component

Reporter: Shaheen Fazim
Impact: high

References

Bug 2059929

#CVE-2026-100764: Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component

Reporter: Mozilla
Impact: high

References

Bug 2061290

#CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2061399

#CVE-2026-100766: Information disclosure in the Networking: JAR component

Reporter: Mozilla
Impact: high

References

Bug 2061526

#CVE-2026-100767: Use-after-free in the Networking: Cache component

Reporter: Mozilla
Impact: high

References

Bug 2063680

#CVE-2026-100768: Use-after-free in the Graphics: WebGPU component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2064832

#CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component

Reporter: Tomer Fichman
Impact: high

References

Bug 2067190

#CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component

Reporter: Mozilla
Impact: high

References

Bug 2068322

#CVE-2026-100771: Undefined behavior in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2068336

#CVE-2026-100772: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068340

#CVE-2026-100773: Use-after-free in the Storage: IndexedDB component

Reporter: Mozilla
Impact: high

References

Bug 2068346

#CVE-2026-100774: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068351

#CVE-2026-100775: Sandbox escape in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068367

#CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2068374

#CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2068375

#CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068406

#CVE-2026-100779: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2068417

#CVE-2026-100780: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068422

#CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Reporter: Mozilla
Impact: high

References

Bug 2068434

#CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068456

#CVE-2026-100783: Uninitialized memory in the Audio/Video component

Reporter: 5up3rh3i
Impact: high

References

Bug 2069804

#CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component

Reporter: 5up3rh3i
Impact: high

References

Bug 2070264

#CVE-2026-100785: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2071064

#CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2071067

#CVE-2026-100787: Sandbox escape in the XUL component

Reporter: Mozilla
Impact: high

References

Bug 2071068

#CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2072413

#CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2072429

#CVE-2026-100790: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2072432

#CVE-2026-100791: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2072433

#CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073266

#CVE-2026-100793: JIT miscompilation in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073268

#CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component

Reporter: Mozilla
Impact: moderate

References

Bug 2028871

#CVE-2026-96869: Information disclosure in the Networking component

Reporter: Carlo Di Dato
Impact: moderate

References

Bug 2041248

#CVE-2026-100795: Denial-of-service in the Networking component

Reporter: Rintaro Kobayashi
Impact: moderate

References

Bug 2048871

#CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component

Reporter: SecBuddyF, Tencent KeenLab (CodeBuddy Security)
Impact: moderate

References

Bug 2049604

#CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component

Reporter: Mozilla
Impact: moderate

References

Bug 2050542

#CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component

Reporter: Mozilla
Impact: moderate

References

Bug 2055694

#CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component

Reporter: 5up3rh3i
Impact: moderate

References

Bug 2056217

#CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component

Reporter: Mozilla
Impact: moderate

References

Bug 2056767

#CVE-2026-100801: Privilege escalation in the DLL Services component

Reporter: Mozilla
Impact: moderate

References

Bug 2057112

#CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component

Reporter: 5up3rh3i
Impact: moderate

References

Bug 2057833

#CVE-2026-100803: Same-origin policy bypass in the WebExtensions component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2057988

#CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences: Backend component

Reporter: Mozilla
Impact: moderate

References

Bug 2058647

#CVE-2026-100805: Race condition, use-after-free in the Audio/Video component

Reporter: Hyeonjun Ahn
Impact: moderate

References

Bug 2058785

#CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component

Reporter: Mozilla
Impact: moderate

References

Bug 2060408

#CVE-2026-100807: Privilege escalation in the DOM: Service Workers component

Reporter: Khanh Nguyen
Impact: moderate

References

Bug 2062740

#CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component

Reporter: WinD39
Impact: moderate

References

Bug 2063488

#CVE-2026-100809: Same-origin policy bypass in the DevTools component

Reporter: Finn Westendorf
Impact: moderate

References

Bug 2063658

#CVE-2026-100810: Other issue in the DevTools component

Reporter: Finn Westendorf
Impact: moderate

References

Bug 2064034

#CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2067973

#CVE-2026-100812: Denial-of-service in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2068335

#CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: moderate

References

Bug 2068376

#CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: moderate

References

Bug 2068385

#CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component

Reporter: Mozilla
Impact: moderate

References

Bug 2068404

#CVE-2026-100816: Site isolation issue in the DOM: Networking component

Reporter: Rintaro Kawasugi
Impact: moderate

References

Bug 2068648

#CVE-2026-100817: Other issue in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: moderate

References

Bug 2068670

#CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component

Reporter: Mozilla
Impact: moderate

References

Bug 2069399

#CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component

Reporter: Mozilla
Impact: moderate

References

Bug 2071069

#CVE-2026-100820: Privilege escalation in the Address Bar component

Reporter: Tran Quac
Impact: moderate

References

Bug 2071645

#CVE-2026-100821: Site isolation issue in the Panning and Zooming component

Reporter: Nguyen Thanh Nguyen
Impact: moderate

References

Bug 2071784

#CVE-2026-100822: Spoofing issue in the Networking: HTTP component

Reporter: Tomoya Nakanishi
Impact: low

References

Bug 2051115

#CVE-2026-100824: Privilege escalation in the Places component

Reporter: Mozilla
Impact: low

References

Bug 2054767

#CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component

Reporter: x0e
Impact: low

References

Bug 2057465

#CVE-2026-100826: Denial-of-service in the Storage: StorageManager component

Reporter: Mozilla
Impact: low

References

Bug 2059222

#CVE-2026-100828: Mitigation bypass in the Bookmarks & History component

Reporter: Rintaro Kawasugi
Impact: low

References

Bug 2066019

#CVE-2026-100829: Mitigation bypass in the DOM: Security component

Reporter: Rintaro Kawasugi
Impact: low

References

Bug 2066321

#CVE-2026-100830: Mitigation bypass in the DOM: Navigation component

Reporter: Finn Westendorf
Impact: low

References

Bug 2066770

#CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component

Reporter: Mozilla
Impact: low

References

Bug 2067172

Firefox browsers

Mozilla VPN

Mozilla Monitor

Firefox Relay

MDN Plus

Thunderbird

0DIN

Tabstack

Otari

About Mozilla

The Mozilla Manifesto

Get Involved

Blog