FAIL › dossier
thunderbird
PRODUCT· dossier confidence 50%
Thunderbird is a critical email client with a severe security posture characterized by a high volume of critical memory safety and sandbox escape vulnerabilities in 2026, including multiple RCEs and privilege escalations. The failure history shows a pattern of unpatched bugs in core components like the JavaScript Engine and DOM, requiring urgent patching and architectural review for DIB/CMMC compliance.
PROFILE
CategoryEmail Client / MessagingWhat they doThunderbird is an open-source email client developed by Mozilla for managing email, calendars, and contacts.
SECURITY POSTURE
Thunderbird exhibits a severe track record of critical memory safety and sandbox escape vulnerabilities, with dozens of critical CVEs in 2026 alone affecting use-after-free, integer overflow, and JIT miscompilation across core components like the JavaScript Engine, DOM, and WebAssembly.
Notable failures
- CVE-2026-74940 critical use-after-free RCE in Graphics: Text
- CVE-2026-84142 critical memory corruption in Thunderbird 154
- CVE-2026-84143 critical memory corruption in Thunderbird 154
- CVE-2026-4689 sandbox escape via incorrect boundary conditions in XPC
- CVE-2026-2777 privilege escalation in Messaging System
Patterns: repeated unpatched memory safety bugs in core components; frequent use-after-free vulnerabilities across DOM, JavaScript Engine, and WebAssembly; recurring sandbox escape and privilege escalation via boundary condition errors
FAILURE HISTORY · 52
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-08-18 | CVE-2026-74940 | critical | Mozilla Firefox and Thunderbird suffered a critical use-after-free vulnerability in the Graphics: Text component, patched in versions 154 and ESR 115.39. |
| 2026-09-01 | CVE-2026-84140 | critical | Mozilla Firefox had a critical site isolation DOM navigation vulnerability fixed in Firefox 155 and ESR 153.2. |
| 2026-09-01 | CVE-2026-84142 | critical | Mozilla Thunderbird 154 contained internally found memory corruption bugs that could have been exploited, fixed in version 155. |
| 2026-09-01 | CVE-2026-84143 | critical | Mozilla Thunderbird 154 and earlier versions contained internally found memory corruption bugs that could have been exploited. |
| 2026-08-18 | CVE-2026-74943 | critical | Mozilla fixed a critical use-after-free vulnerability in Firefox and Thunderbird's ImageLib component. |
| 2026-08-18 | CVE-2026-74936 | critical | Mozilla's Firefox and Thunderbird contained a critical use-after-free vulnerability in the WebAssembly component that was patched in version 154. |
| 2026-08-18 | CVE-2026-74944 | critical | Mozilla Firefox and Thunderbird contained a critical use-after-free vulnerability in the DOM component that was patched in versions 154 and 140.14. |
| 2026-09-01 | CVE-2026-84141 | critical | Mozilla Firefox had an integer overflow vulnerability in its ImageLib component that was patched in Firefox 155 and Firefox ESR 153.2. |
| 2026-06-16 | CVE-2026-12293 | critical | CVE-2026-12293: Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed i |
| 2026-04-07 | CVE-2026-5735 | critical | CVE-2026-5735: Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t |
| 2026-04-07 | CVE-2026-5734 | critical | CVE-2026-5734: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire |
| 2026-03-24 | CVE-2026-4689 | critical | CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPC |
| 2026-03-24 | CVE-2026-4692 | critical | CVE-2026-4692: Sandbox escape in the Responsive Design Mode component. This vulnerability was f |
| 2026-02-24 | CVE-2026-2766 | critical | CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was f |
| 2026-02-24 | CVE-2026-2765 | critical | CVE-2026-2765: Use-after-free in the JavaScript Engine component. This vulnerability was fixed |
| 2026-02-24 | CVE-2026-2772 | critical | CVE-2026-2772: Use-after-free in the Audio/Video: Playback component. This vulnerability was fi |
| 2026-02-24 | CVE-2026-2771 | critical | CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component. This vulnerability was fix |
| 2026-02-24 | CVE-2026-2770 | critical | CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was f |
| 2026-02-24 | CVE-2026-2767 | critical | CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was |
| 2026-02-24 | CVE-2026-2773 | critical | CVE-2026-2773: Incorrect boundary conditions in the Web Audio component. This vulnerability was |
| 2026-02-24 | CVE-2026-2774 | critical | CVE-2026-2774: Integer overflow in the Audio/Video component. This vulnerability was fixed in F |
| 2026-02-24 | CVE-2026-2775 | critical | CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixe |
| 2026-02-24 | CVE-2026-2776 | critical | CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component i |
| 2026-02-24 | CVE-2026-2777 | critical | CVE-2026-2777: Privilege escalation in the Messaging System component. This vulnerability was f |
| 2026-02-24 | CVE-2026-2768 | critical | CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed |
| 2026-02-24 | CVE-2026-2758 | critical | CVE-2026-2758: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in |
| 2026-02-24 | CVE-2026-2759 | critical | CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerab |
| 2026-02-24 | CVE-2026-2761 | critical | CVE-2026-2761: Sandbox escape in the Graphics: WebRender component. This vulnerability was fixe |
| 2026-02-24 | CVE-2026-2796 | critical | CVE-2026-2796: JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability |
| 2026-02-24 | CVE-2026-2760 | critical | CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c |
| 2026-02-24 | CVE-2026-2762 | critical | CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component. This vulnerabili |
| 2026-02-24 | CVE-2026-2763 | critical | CVE-2026-2763: Use-after-free in the JavaScript Engine component. This vulnerability was fixed |
| 2026-02-24 | CVE-2026-2764 | critical | CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This |
| 2026-02-24 | CVE-2026-2792 | critical | CVE-2026-2792: Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox |
| 2026-02-24 | CVE-2026-2793 | critical | CVE-2026-2793: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird |
| 2026-02-24 | CVE-2026-2795 | critical | CVE-2026-2795: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in |
| 2026-02-24 | CVE-2026-2797 | critical | CVE-2026-2797: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in |
| 2026-02-24 | CVE-2026-2799 | critical | CVE-2026-2799: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed i |
| 2026-02-24 | CVE-2026-2807 | critical | CVE-2026-2807: Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bug |
| 2026-02-24 | CVE-2026-2778 | critical | CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML comp |
| 2026-02-24 | CVE-2026-2757 | critical | CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnera |
| 2025-12-09 | CVE-2025-14321 | critical | CVE-2025-14321: Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed |
| 2025-12-09 | CVE-2025-14330 | critical | CVE-2025-14330: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w |
| 2025-12-09 | CVE-2025-14326 | critical | CVE-2025-14326: Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed i |
| 2025-12-09 | CVE-2025-14324 | critical | CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w |
| 2025-08-19 | CVE-2025-9187 | critical | CVE-2025-9187: Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bug |
| 2025-02-04 | CVE-2025-1009 | critical | CVE-2025-1009: An attacker could have caused a use-after-free via crafted XSLT data, leading to |
| 2025-02-04 | CVE-2025-1017 | critical | CVE-2025-1017: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, a |
| 2025-02-04 | CVE-2025-1020 | critical | CVE-2025-1020: Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bug |
| 2025-02-04 | CVE-2025-1016 | critical | CVE-2025-1016: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, |
| 2024-10-09 | CVE-2024-9680 | critical | CVE-2024-9680: An attacker was able to achieve code execution in the content process by exploit |
| 2022-12-22 | CVE-2022-26486 | critical | CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free |
Open questions: Current patching SLA for Thunderbird · ESR support timeline for Thunderbird
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-05 03:52:10.298586+00:00