# Mozilla Thunderbird-Esr vulnerabilities Source: https://junglewise.ai/threats/technologies/thunderbird-esr Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/thunderbird-esr.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 86 vulnerabilities in Mozilla Thunderbird-Esr: 0 in the last 7 days and 57 in the last 90 days, 26 of them critical and 2 exploited in the wild. The most recent, CVE-2026-109781, was published on 13 October 2026. 20 vulnerabilities in the last four weeks, up 43% on the four before (14). 2 critical against 3. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 57 - All time: 86 (26 critical, 2 exploited in the wild) ## About Mozilla Thunderbird-Esr An Extended Support Release version of the open-source email client designed for organizations requiring long-term stability. ## Latest Mozilla Thunderbird-Esr vulnerabilities - [CVE-2026-109781: Mozilla Firefox denial-of-service in Printing: Output](https://junglewise.ai/threats/cve-2026-109781-denial-of-service-in-the-printing-output-component-this) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-109776: Mozilla Firefox race condition in XPCOM component](https://junglewise.ai/threats/cve-2026-109776-race-condition-in-the-xpcom-component-this-vulnerability-was) (medium, CVSS 4.2, published 13 Oct 2026) - [CVE-2026-109775: Mozilla Firefox denial-of-service in WebRTC component](https://junglewise.ai/threats/cve-2026-109775-denial-of-service-in-the-webrtc-component-this-vulnerability-was) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-109767: Mozilla Firefox information disclosure in Networking component](https://junglewise.ai/threats/cve-2026-109767-information-disclosure-in-the-networking-component-this) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109766: Firefox mitigation bypass in Enterprise Policies](https://junglewise.ai/threats/cve-2026-109766-mitigation-bypass-in-the-enterprise-policies-component-this) (info, published 13 Oct 2026) - [CVE-2026-109764: Mozilla Firefox Enterprise Policies mitigation bypass](https://junglewise.ai/threats/cve-2026-109764-mitigation-bypass-in-the-enterprise-policies-component-this) (info, published 13 Oct 2026) - [CVE-2026-109763: Mozilla Firefox file handling mitigation bypass](https://junglewise.ai/threats/cve-2026-109763-mitigation-bypass-in-the-file-handling-component-this) (info, published 13 Oct 2026) - [CVE-2026-109762: Mozilla Firefox incorrect boundary conditions in SVG component](https://junglewise.ai/threats/cve-2026-109762-incorrect-boundary-conditions-in-the-svg-component-this) (info, published 13 Oct 2026) - [CVE-2026-109752: Mozilla Firefox use-after-free in DOM: Workers component](https://junglewise.ai/threats/cve-2026-109752-use-after-free-in-the-dom-workers-component-this-vulnerability) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109740: Firefox sandbox escape in Widget Win32 due to incorrect boundary conditions](https://junglewise.ai/threats/cve-2026-109740-sandbox-escape-due-to-incorrect-boundary-conditions-in-the) (info, published 13 Oct 2026) - [CVE-2026-109737: Firefox mitigation bypass in Enterprise Policies](https://junglewise.ai/threats/cve-2026-109737-mitigation-bypass-in-the-enterprise-policies-component-this) (info, published 13 Oct 2026) - [CVE-2026-109734: Firefox mitigation bypass in DOM Security component](https://junglewise.ai/threats/cve-2026-109734-mitigation-bypass-in-the-dom-security-component-this) (info, published 13 Oct 2026) - [CVE-2026-109731: Mozilla Firefox incorrect boundary conditions in Canvas2D](https://junglewise.ai/threats/cve-2026-109731-incorrect-boundary-conditions-in-the-graphics-canvas2d-component) (info, published 13 Oct 2026) - [CVE-2026-109724: Firefox use-after-free in DOM: Core & HTML](https://junglewise.ai/threats/cve-2026-109724-use-after-free-in-the-dom-core-html-component-this-vulnerability) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109723: Mozilla Firefox integer overflow in Layout: Text and Fonts](https://junglewise.ai/threats/cve-2026-109723-integer-overflow-in-the-layout-text-and-fonts-component-this) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109721: Mozilla Firefox incorrect boundary conditions in JavaScript Engine JIT](https://junglewise.ai/threats/cve-2026-109721-incorrect-boundary-conditions-in-the-javascript-engine-jit) (info, published 13 Oct 2026) - [CVE-2026-109713: Mozilla Firefox use-after-free in Crash Reporting](https://junglewise.ai/threats/cve-2026-109713-use-after-free-in-the-crash-reporting-component-this) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109711: Mozilla Firefox use-after-free in Graphics Canvas2D](https://junglewise.ai/threats/cve-2026-109711-use-after-free-in-the-graphics-canvas2d-component-this) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109708: Firefox sandbox escape due to incorrect boundary conditions in Networking](https://junglewise.ai/threats/cve-2026-109708-sandbox-escape-due-to-incorrect-boundary-conditions-in-the) (critical, CVSS 9.6, published 13 Oct 2026) - [CVE-2026-109707: Firefox sandbox escape in Networking component use-after-free](https://junglewise.ai/threats/cve-2026-109707-sandbox-escape-due-to-use-after-free-in-the-networking-component) (critical, CVSS 9.6, published 13 Oct 2026) - [CVE-2026-92079: Mozilla Firefox mitigation bypass in Widget: Win32](https://junglewise.ai/threats/cve-2026-92079-mozilla-firefox-mitigation-bypass-in-widget-win32) (critical, CVSS 9.1, published 15 Sep 2026) - [CVE-2026-92067: Mozilla Firefox use-after-free in Widget: Gtk component](https://junglewise.ai/threats/cve-2026-92067-mozilla-firefox-use-after-free-in-widget-gtk-component) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-92060: Mozilla Firefox use-after-free in Internationalization component](https://junglewise.ai/threats/cve-2026-92060-mozilla-firefox-use-after-free-in-internationalization-component) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-92058: Mozilla Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-92058-mozilla-firefox-use-after-free-in-graphics-component) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-92057: Mozilla Firefox mitigation bypass in Enterprise Policies component](https://junglewise.ai/threats/cve-2026-92057-mozilla-firefox-mitigation-bypass-in-enterprise-policies) (critical, CVSS 9.1, published 15 Sep 2026) ## Most severe Mozilla Thunderbird-Esr vulnerabilities - [CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability](https://junglewise.ai/threats/cve-2013-1690-mozilla-firefox-and-thunderbird-denial-of-service-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Mar 2022) - [CVE-2013-1675: Mozilla Firefox Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2013-1675-mozilla-firefox-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 6.5, published 3 Mar 2022) - [CVE-2026-75874: Mozilla Firefox Remote Settings Client sandbox escape](https://junglewise.ai/threats/cve-2026-75874-mozilla-firefox-remote-settings-client-sandbox-escape) (critical, CVSS 10, published 18 Aug 2026) - [CVE-2026-4688: Mozilla Firefox and Thunderbird sandbox escape in Disability Access APIs](https://junglewise.ai/threats/cve-2026-4688-mozilla-firefox-and-thunderbird-sandbox-escape-in-disability) (critical, CVSS 10, published 24 Mar 2026) - [CVE-2026-2768: Mozilla Firefox and Thunderbird sandbox escape in IndexedDB](https://junglewise.ai/threats/cve-2026-2768-mozilla-firefox-and-thunderbird-sandbox-escape-in-indexeddb) (critical, CVSS 10, published 24 Feb 2026) - [CVE-2026-74964: Mozilla Firefox integer overflow in Graphics component](https://junglewise.ai/threats/cve-2026-74964-mozilla-firefox-integer-overflow-in-graphics-component) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-84141: Mozilla Firefox integer overflow in Graphics: ImageLib](https://junglewise.ai/threats/cve-2026-84141-mozilla-firefox-integer-overflow-in-graphics-imagelib) (critical, CVSS 9.8, published 1 Sep 2026) - [CVE-2026-74988: Mozilla Thunderbird memory corruption in ESR 153.0 and 153](https://junglewise.ai/threats/cve-2026-74988-mozilla-thunderbird-memory-corruption-in-esr-153-0-and-153) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-84134: Mozilla Firefox other issue in Profile Backup component](https://junglewise.ai/threats/cve-2026-84134-mozilla-firefox-other-issue-in-profile-backup-component) (critical, CVSS 9.8, published 1 Sep 2026) - [CVE-2026-74985: Mozilla Firefox privilege escalation in Enterprise Policies](https://junglewise.ai/threats/cve-2026-74985-mozilla-firefox-privilege-escalation-in-enterprise-policies) (critical, CVSS 9.8, published 18 Aug 2026) ## Vulnerabilities per week 20 vulnerabilities in the last four weeks, up 43% on the four before (14). 2 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 12 | 4 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 11 | 3 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 14 | 3 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 20 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Mozilla technologies - [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox): 869 vulnerabilities - [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr): 642 vulnerabilities - [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird): 396 vulnerabilities - [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios): 17 vulnerabilities - [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android): 11 vulnerabilities - [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile): 7 vulnerabilities - [Mozilla Firefox Focus](https://junglewise.ai/threats/technologies/firefox-focus-for-android): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mozilla Thunderbird-Esr vulnerabilities", https://junglewise.ai/threats/technologies/thunderbird-esr, 13 November 2026.