Mozilla Thunderbird any version

Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird < 133.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Use-after-free in the Widget: Cocoa component

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the XML component

Denial-of-service in the Libraries component in NSS

Use-after-free in the JavaScript: WebAssembly component

A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the Libraries component in NSS

Information disclosure in the WebRTC component

A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.

Use-after-free in the DOM: Bindings (WebIDL) component

Information disclosure, mitigation bypass in the Settings UI component

Use-after-free in the DOM: Networking component

Information disclosure in the Networking: HTTP component

Information disclosure in the Graphics: WebGPU component

Information disclosure in the Form Autofill component

Information disclosure due to side-channel in the Storage: Cache API component

Incorrect boundary conditions, integer overflow in the Audio/Video component

Incorrect boundary conditions in the Libraries component in NSS

Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2

Information disclosure in the Graphics: WebGPU component

Information disclosure in the IP Protection component

Information disclosure in the DOM: Security component

Information disclosure in the IP Protection component

Allowed UNC hostnames for attachments interpreted as a regular expression

Memory safety bugs fixed in Firefox 150 and Thunderbird 150

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

Spoofing issue in the Web Speech component

Spoofing issue in WebExtensions

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.