Red Hat Security Advisory: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This advisory covers a broad set of security vulnerabilities in Mozilla Thunderbird, fixed in versions 140.13 and 153. The flaws include an off-by-one out-of-bounds read in the MIME header parser (CVE-2026-14899), invalid pointer dereferences, site isolation issues, sandbox escapes due to use-after-free bugs, JIT miscompilations, privilege escalations, mitigation bypasses, and information disclosures in multiple components such as DOM navigation, JavaScript WebAssembly, Audio/Video (cubeb and GMP), Networking (HTTP, DNS, WebSockets), Storage (IndexedDB), and Graphics (WebGPU, ImageLib). Some vulnerabilities have publicly available exploit code, but no known in-the-wild exploitation has been reported. The vulnerabilities are mitigated by disabling scripting when reading mail, limiting direct exploitation via email. Red Hat's security update addresses these issues in Thunderbird versions prior to 140.13 and 153, including their Enterprise Linux AppStream versions 8, 9, and 10 on ppc64le architecture.
Potential Impact
The vulnerabilities collectively pose high to critical impact risks including potential arbitrary code execution, sandbox escapes, privilege escalation, information disclosure, and denial-of-service conditions. While direct exploitation through email is generally not feasible due to disabled scripting, the vulnerabilities present significant risks in browser or browser-like contexts where scripting is enabled. Some flaws have publicly available exploit code, increasing the risk of exploitation if the environment permits. The off-by-one error in MIME header parsing can cause crashes. Memory safety bugs could lead to arbitrary code execution with sufficient effort. Overall, these vulnerabilities threaten confidentiality, integrity, and availability of the affected Thunderbird installations.
Mitigation Recommendations
A security update fixing these vulnerabilities is available and should be applied. Red Hat has released Thunderbird version 140.13 and Mozilla has released Thunderbird 153 which address these issues. Users should upgrade to these fixed versions as soon as possible. Since scripting is disabled when reading mail in Thunderbird, the risk of exploitation through email is low. No additional mitigations are explicitly required beyond applying the official updates.
Red Hat Security Advisory: thunderbird security update
Description
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers a broad set of security vulnerabilities in Mozilla Thunderbird, fixed in versions 140.13 and 153. The flaws include an off-by-one out-of-bounds read in the MIME header parser (CVE-2026-14899), invalid pointer dereferences, site isolation issues, sandbox escapes due to use-after-free bugs, JIT miscompilations, privilege escalations, mitigation bypasses, and information disclosures in multiple components such as DOM navigation, JavaScript WebAssembly, Audio/Video (cubeb and GMP), Networking (HTTP, DNS, WebSockets), Storage (IndexedDB), and Graphics (WebGPU, ImageLib). Some vulnerabilities have publicly available exploit code, but no known in-the-wild exploitation has been reported. The vulnerabilities are mitigated by disabling scripting when reading mail, limiting direct exploitation via email. Red Hat's security update addresses these issues in Thunderbird versions prior to 140.13 and 153, including their Enterprise Linux AppStream versions 8, 9, and 10 on ppc64le architecture.
Potential Impact
The vulnerabilities collectively pose high to critical impact risks including potential arbitrary code execution, sandbox escapes, privilege escalation, information disclosure, and denial-of-service conditions. While direct exploitation through email is generally not feasible due to disabled scripting, the vulnerabilities present significant risks in browser or browser-like contexts where scripting is enabled. Some flaws have publicly available exploit code, increasing the risk of exploitation if the environment permits. The off-by-one error in MIME header parsing can cause crashes. Memory safety bugs could lead to arbitrary code execution with sufficient effort. Overall, these vulnerabilities threaten confidentiality, integrity, and availability of the affected Thunderbird installations.
Mitigation Recommendations
A security update fixing these vulnerabilities is available and should be applied. Red Hat has released Thunderbird version 140.13 and Mozilla has released Thunderbird 153 which address these issues. Users should upgrade to these fixed versions as soon as possible. Since scripting is disabled when reading mail in Thunderbird, the risk of exploitation through email is low. No additional mitigations are explicitly required beyond applying the official updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6667-m7mf-jcr7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-14899"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6150d99c2644c7f8da0fbb
Added to database: 07/22/2026, 23:23:05 UTC
Last enriched: 08/11/2026, 20:02:25 UTC
Last updated: 09/04/2026, 10:52:07 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.