{"id":"CVE-2026-118174","aliases":["DEBIAN-CVE-2026-118174","EUVD-2026-111351","GHSA-7h4p-h257-qp65","MGASA-2026-0583","UBUNTU-CVE-2026-118174","openSUSE-SU-2026:12339-1"],"status":"published","title":"Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00372,"percentile":0.31565,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-829"],"published":"2026-10-27T18:16:28Z","modified":"2026-11-10T05:45:03Z","fixes":[{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:153.6.0esr-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:153.6.0esr-1~deb13u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.6.0esr-1~deb12u2"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.6.0esr-1~deb13u1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2","1:153.6.0esr-1~deb13u1","1:155.0.1-1","1:155.0.1-2","1:157.0-1","1:159.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.1"}]}],"bundled":153}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2080910","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118174"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122"},{"url":"https://github.com/advisories/GHSA-7h4p-h257-qp65"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-118174","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0583.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36593","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.6.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-118174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118174","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/#CVE-2026-118174","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118180","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-118174","title":"Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T18:16:28.729Z","modified":"2026-11-04T16:50:49.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-829"],"updated_at":"2026-11-04T17:34:39.974757Z"}],"euvd":[{"id":"EUVD-2026-111351","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T18:16:28Z","modified":"2026-11-04T16:50:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-04T18:12:44.477339Z"}],"ghsa":[{"id":"GHSA-7h4p-h257-qp65","title":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically...","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T21:33:41Z","modified":"2026-11-04T18:30:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-829"],"updated_at":"2026-11-04T18:55:44.84967Z"}],"nvd":[{"id":"CVE-2026-118174","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T19:17:29.037Z","modified":"2026-11-04T17:17:33.447Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-829"],"updated_at":"2026-11-04T20:08:23.117709Z"}],"osv":[{"id":"DEBIAN-CVE-2026-118174","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T19:17:29.037Z","modified":"2026-11-05T10:00:41.03477999Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-118174","description":"When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","status":"published","published":"2026-10-27T19:17:00Z","modified":"2026-11-06T01:00:35.535425432Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T01:33:05.666804Z"},{"id":"MGASA-2026-0583","title":"Updated thunderbird package fixes security vulnerabilities","description":"Displaying a message could load an attacker-chosen URL through an\nOpenPGP key attachment. (CVE-2026-118174)\nContent of other messages could be included when replying to a crafted\nmessage. (CVE-2026-118175)\nBypass of remote UNC path restriction in mailbox: URLs.\n(CVE-2026-118176)\nCalendar discovery accepted local file and remote network share\nlocations. (CVE-2026-118177)\nRSS feed could redirect its subscription to a local file or network\nshare. (CVE-2026-118178)\nRequest forgery via news: links. (CVE-2026-118179)\nMatrix homeserver could redirect the chat session to a local file or\nnetwork share. (CVE-2026-118180)\nInteger overflow in libmime buffer growth could lead to heap corruption.\n(CVE-2026-110247)\nUse-after-free in S/MIME decryption during a security device password\nprompt. (CVE-2026-113869)\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core \u0026 HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core \u0026 HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-10T05:45:03.377121818Z","updated_at":"2026-11-10T05:53:01.608209Z"},{"id":"openSUSE-SU-2026:12339-1","title":"MozillaThunderbird-153.6.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:07.691910442Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}