# Mozilla Thunderbird vulnerabilities Source: https://junglewise.ai/threats/technologies/thunderbird Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/thunderbird.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 396 vulnerabilities in Mozilla Thunderbird: 5 in the last 7 days and 255 in the last 90 days, 114 of them critical and 13 exploited in the wild. The most recent, CVE-2026-126136, was published on 10 November 2026. 91 vulnerabilities in the last four weeks, up 18% on the four before (77). 4 critical against 21. ## Counts - Last 7 days: 5 - Last 30 days: 16 - Last 90 days: 255 - All time: 396 (114 critical, 13 exploited in the wild) ## About Mozilla Thunderbird Thunderbird is a free and open-source cross-platform email client, personal information manager, news client, RSS and chat client developed by the Mozilla Foundation. ## Latest Mozilla Thunderbird vulnerabilities - [CVE-2026-126136: Thunderbird OAuth2 access token leak over HTTP with Exchange accounts](https://junglewise.ai/threats/cve-2026-126136-for-exchange-accounts-using-ews-or-microsoft-graph-with-oauth2) (info, published 10 Nov 2026) - [CVE-2026-126135: Mozilla Thunderbird SMTP/POP3 response injection via STARTTLS](https://junglewise.ai/threats/cve-2026-126135-if-an-attacker-was-able-to-perform-a-man-in-the-middle-attack-on) (info, published 10 Nov 2026) - [CVE-2026-126134: Thunderbird NTLM credential leak via feed subscription to file URL](https://junglewise.ai/threats/cve-2026-126134-thunderbird-allowed-feed-subscriptions-to-file-urls-that-point) (info, published 10 Nov 2026) - [CVE-2026-126133: Thunderbird calendar server credentials sent to HTTP proxy](https://junglewise.ai/threats/cve-2026-126133-when-a-caldav-or-ics-calendar-was-accessed-through-an-http-proxy) (info, published 10 Nov 2026) - [CVE-2026-126132: Thunderbird attachment replacement disclosure via link files](https://junglewise.ai/threats/cve-2026-126132-when-a-message-was-forwarded-inline-edited-as-new-or-had-an) (info, published 10 Nov 2026) - [CVE-2026-118180: Thunderbird Matrix homeserver URL validation bypass](https://junglewise.ai/threats/cve-2026-118180-when-logging-in-to-a-matrix-account-thunderbird-used-the) (info, published 27 Oct 2026) - [CVE-2026-118179: Mozilla Thunderbird request forgery via news: links](https://junglewise.ai/threats/cve-2026-118179-clicking-a-news-or-snews-link-that-referenced-a-message-id-made) (info, published 27 Oct 2026) - [CVE-2026-118178: Mozilla Thunderbird RSS feed URL redirection to file: URL](https://junglewise.ai/threats/cve-2026-118178-a-remote-rss-feed-could-use-the-itunes-new-feed-url-or) (info, published 27 Oct 2026) - [CVE-2026-118177: Mozilla Thunderbird calendar discovery accepts local files and network shares](https://junglewise.ai/threats/cve-2026-118177-when-looking-for-calendars-in-a-directory-on-a-server-during) (info, published 27 Oct 2026) - [CVE-2026-118176: Thunderbird mailbox: URL UNC path restriction bypass on Windows](https://junglewise.ai/threats/cve-2026-118176-thunderbird-s-check-that-prevents-mailbox-urls-from-accessing) (info, published 27 Oct 2026) - [CVE-2026-118175: Mozilla Thunderbird message content disclosure in reply/forward](https://junglewise.ai/threats/cve-2026-118175-when-replying-to-forwarding-or-editing-a-crafted-email-message) (info, published 27 Oct 2026) - [CVE-2026-118174: Mozilla Thunderbird OpenPGP key attachment remote content loading](https://junglewise.ai/threats/cve-2026-118174-when-a-message-containing-an-openpgp-key-attachment-was) (info, published 27 Oct 2026) - [CVE-2026-113869: Thunderbird use-after-free in S/MIME decryption](https://junglewise.ai/threats/cve-2026-113869-when-thunderbird-asked-for-a-security-device-password-for) (medium, CVSS 5.4, published 20 Oct 2026) - [CVE-2026-113868: Thunderbird uninitialized memory disclosure in NTLM authentication](https://junglewise.ai/threats/cve-2026-113868-when-authenticating-to-a-pop3-or-smtp-server-using-ntlm) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-113867: Thunderbird XMPP stanza injection in chat](https://junglewise.ai/threats/cve-2026-113867-thunderbird-did-not-escape-attribute-values-when-serializing) (info, published 20 Oct 2026) - [CVE-2026-113866: Mozilla Thunderbird account password disclosure in Exchange AutoDiscover](https://junglewise.ai/threats/cve-2026-113866-when-setting-up-an-account-thunderbird-s-exchange-autodiscover) (medium, CVSS 5.9, published 20 Oct 2026) - [CVE-2026-110249: Thunderbird denial-of-service in Exchange component](https://junglewise.ai/threats/cve-2026-110249-a-malicious-compromised-or-mitm-controlled-exchange-server-can) (info, published 13 Oct 2026) - [CVE-2026-110247: Mozilla Thunderbird integer overflow in libmime buffer growth](https://junglewise.ai/threats/cve-2026-110247-several-buffer-growth-sites-in-libmime-performed-size-arithmetic) (info, published 13 Oct 2026) - [CVE-2026-109783: Mozilla Firefox ESR mitigation bypass in File Handling](https://junglewise.ai/threats/cve-2026-109783-mitigation-bypass-in-the-file-handling-component-this) (info, published 13 Oct 2026) - [CVE-2026-109782: Mozilla Firefox ESR and Thunderbird mitigation bypass in File Handling](https://junglewise.ai/threats/cve-2026-109782-mitigation-bypass-in-the-file-handling-component-this) (info, published 13 Oct 2026) - [CVE-2026-109781: Mozilla Firefox denial-of-service in Printing: Output](https://junglewise.ai/threats/cve-2026-109781-denial-of-service-in-the-printing-output-component-this) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-109780: Firefox mitigation bypass in DOM: Core & HTML](https://junglewise.ai/threats/cve-2026-109780-mitigation-bypass-in-the-dom-core-html-component-this) (info, published 13 Oct 2026) - [CVE-2026-109779: Firefox race condition in Networking DNS component](https://junglewise.ai/threats/cve-2026-109779-race-condition-in-the-networking-dns-component-this) (medium, CVSS 4.2, published 13 Oct 2026) - [CVE-2026-109778: Mozilla Firefox privilege escalation in WebExtensions](https://junglewise.ai/threats/cve-2026-109778-privilege-escalation-in-the-webextensions-component-this) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-109777: Firefox Information disclosure in Storage: IndexedDB](https://junglewise.ai/threats/cve-2026-109777-information-disclosure-in-the-storage-indexeddb-component-this) (medium, CVSS 4.3, published 13 Oct 2026) ## Most severe Mozilla Thunderbird vulnerabilities - [CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability](https://junglewise.ai/threats/cve-2019-11708-mozilla-firefox-and-thunderbird-sandbox-escape-vulnerability) (critical, exploited in the wild, CVSS 10, published 23 May 2022) - [CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructor](https://junglewise.ai/threats/cve-2010-3765-mozilla-multiple-products-memory-corruption-in) (critical, exploited in the wild, CVSS 9.8, published 6 Oct 2025) - [CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2024-9680-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Oct 2024) - [CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26486-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.6, published 7 Mar 2022) - [CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2015-4495-mozilla-firefox-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 25 May 2022) - [CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-11707-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 23 May 2022) - [CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability](https://junglewise.ai/threats/cve-2013-1690-mozilla-firefox-and-thunderbird-denial-of-service-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Mar 2022) - [CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26485-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 7 Mar 2022) - [CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-17026-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Nov 2021) - [CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2020-6819-mozilla-firefox-and-thunderbird-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 3 Nov 2021) ## Vulnerabilities per week 91 vulnerabilities in the last four weeks, up 18% on the four before (77). 4 critical against 21. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 52 | 15 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 30 | 10 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 76 | 21 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 80 | 4 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 7 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Other Mozilla technologies - [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox): 869 vulnerabilities - [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr): 642 vulnerabilities - [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr): 86 vulnerabilities - [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios): 17 vulnerabilities - [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android): 11 vulnerabilities - [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile): 7 vulnerabilities - [Mozilla Firefox Focus](https://junglewise.ai/threats/technologies/firefox-focus-for-android): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mozilla Thunderbird vulnerabilities", https://junglewise.ai/threats/technologies/thunderbird, 13 November 2026.