Mozilla Foundation Security Advisory 2026-110

Security Vulnerabilities fixed in Thunderbird 153.5

Announced

October 13, 2026

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 153.5

Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-110249: Denial-of-service in the Exchange email component

Reporter: SuyZ <[email protected]>
Impact: low

Description

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours.

References

Bug 2077826

#CVE-2026-109704: Privilege escalation in the Application Update component

Reporter: Noel
Impact: high

References

Bug 2037979

#CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2040905

#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component

Reporter: Mozilla
Impact: high

References

Bug 2053649

#CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059150

#CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059151

#CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2067976

#CVE-2026-109710: Use-after-free in the Graphics: Text component

Reporter: Mozilla
Impact: high

References

Bug 2068338

#CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2068344

#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068420

#CVE-2026-109713: Use-after-free in the Crash Reporting component

Reporter: locust1b
Impact: high

References

Bug 2068421

#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073267

#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073269

#CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter: Mozilla
Impact: high

References

Bug 2073647

#CVE-2026-109718: Use-after-free in the XML component

Reporter: Mozilla
Impact: high

References

Bug 2073692

#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: high

References

Bug 2073969

#CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074160

#CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074161

#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074164

#CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074171

#CVE-2026-109724: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074193

#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074208

#CVE-2026-109726: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2074212

#CVE-2026-109727: Use-after-free in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2074213

#CVE-2026-109728: Use-after-free in the DOM: Animation component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074625

#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component

Reporter: Tomer Fichman
Impact: high

References

Bug 2074632

#CVE-2026-109730: Integer overflow in the Graphics component

Reporter: Robert Longson
Impact: high

References

Bug 2074896

#CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2075436

#CVE-2026-109732: Use-after-free in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2075998

#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076269

#CVE-2026-109734: Mitigation bypass in the DOM: Security component

Reporter: Mirko Brodesser
Impact: moderate

References

Bug 1926318

#CVE-2026-109736: Frame poisoning in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2029784

#CVE-2026-109737: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2044525

#CVE-2026-109738: Use-after-free in the Audio/Video: Playback component

Reporter: Mozilla
Impact: moderate

References

Bug 2047722

#CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: moderate

References

Bug 2057113

#CVE-2026-109741: Use-after-free in the Storage: Bucket File System component

Reporter: Mozilla
Impact: moderate

References

Bug 2058651

#CVE-2026-109742: Information disclosure in the PDF Viewer component

Reporter: Mozilla
Impact: moderate

References

Bug 2058800

#CVE-2026-109743: Privilege escalation in the Panning and Zooming component

Reporter: Mozilla
Impact: moderate

References

Bug 2059195

#CVE-2026-109744: Other issue in the DOM: File component

Reporter: Mozilla
Impact: moderate

References

Bug 2059211

#CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Reporter: Mozilla
Impact: moderate

References

Bug 2061784

#CVE-2026-109782: Mitigation bypass in the File Handling component

Reporter: Abdulrahman Alzahrani
Impact: moderate

References

Bug 2067465

#CVE-2026-109751: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2068372

#CVE-2026-109752: Use-after-free in the DOM: Workers component

Reporter: Mozilla
Impact: moderate

References

Bug 2068407

#CVE-2026-109753: Incorrect boundary conditions in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2068441

#CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component

Reporter: Mozilla
Impact: moderate

References

Bug 2068443

#CVE-2026-109756: Privilege escalation in the DOM: Navigation component

Reporter: Mozilla
Impact: moderate

References

Bug 2069258

#CVE-2026-109757: Sandbox escape due to race condition in the Networking component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2069910

#CVE-2026-109759: Site isolation issue in the Networking component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070252

#CVE-2026-109760: Mitigation bypass in the Networking: HTTP component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070633

#CVE-2026-109762: Incorrect boundary conditions in the SVG component

Reporter: Mozilla
Impact: moderate

References

Bug 2072438

#CVE-2026-109763: Mitigation bypass in the File Handling component

Reporter: Riku Bamba
Impact: moderate

References

Bug 2072501

#CVE-2026-109764: Mitigation bypass in the Enterprise Policies component

Reporter: HyeonSeung Kim
Impact: moderate

References

Bug 2073382

#CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: moderate

References

Bug 2073396

#CVE-2026-109766: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2074406

#CVE-2026-109767: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2074963

#CVE-2026-109783: Mitigation bypass in the File Handling component

Reporter: Mozilla
Impact: moderate

References

Bug 2075533

#CVE-2026-109770: Spoofing issue in the DOM: Web Serial component

Reporter: Mozilla
Impact: low

References

Bug 2059230

#CVE-2026-109775: Denial-of-service in the WebRTC component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2068255

#CVE-2026-109776: Race condition in the XPCOM component

Reporter: Mozilla
Impact: low

References

Bug 2069395

#CVE-2026-109777: Information disclosure in the Storage: IndexedDB component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2069638

#CVE-2026-109778: Privilege escalation in the WebExtensions component

Reporter: Mozilla
Impact: low

References

Bug 2070547

#CVE-2026-109781: Denial-of-service in the Printing: Output component

Reporter: Nguyen Thanh Nguyen
Impact: low

References

Bug 2072852