A vulnerability in Mozilla Thunderbird versions prior to 128.10.1 and 138.0.1 allowed crafted emails to display tracking links as attachments. When a user opened such an attachment, Thunderbird would automatically access the linked web page, bypassing the configuration to block remote content. This behavior was due to Thunderbird processing the X-Mozilla-External-Attachment-URL header incorrectly. The issue has been fixed by disallowing access to web pages listed in this header.