Mozilla Thunderbird CVE-2026-57963

The victim must have Thunderbird's built-in chat feature enabled and be actively connected to a Matrix or XMPP account - email-only use of Thunderbird is not affected. The attacker must be able to deliver a chat message to the victim, which in practice means having an account on any Matrix homeserver or XMPP server in a federated relationship with the victim's server, or sending a direct message to a publicly reachable account. No authentication to the victim's system is required. Exploitation is further limited to Thunderbird versions prior to 152.0.1 and 140.12.1 ESR; patched installations are not vulnerable. The CVSS vector PR:N/UI:N reflects that no victim interaction beyond passive message receipt is needed, but the 'chat feature must be active' prerequisite is a meaningful real-world filter.

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N signals a low-complexity, network-reachable flaw with no privileges required and no scope change. However, the impact is deliberately bounded at Low for both Confidentiality and Integrity - no code execution or persistent access is implied. EPSS at 0.14% (4th percentile) is low, and SSVC independently confirms exploitation status as 'none' at time of analysis, aligning with the absence of a CISA KEV entry. The SSVC 'automatable: yes' flag is the strongest risk amplifier - a threat actor can script mass delivery of malicious chat messages across federated networks without manual intervention. The primary real-world risk is phishing (spoofed login prompts, deceptive links) and UI manipulation rather than system compromise. This is a genuine patch-now-but-not-emergency priority: low exploitation likelihood today, but the automatable phishing surface makes delayed remediation inadvisable. No conflict between signals is detected - all sources consistently describe a moderate, non-escalating flaw.

An attacker creates an account on any public Matrix homeserver or XMPP server that federates with the victim's server, then sends the victim a chat message containing crafted HTML and CSS - for example, an overlay that mimics a Thunderbird password prompt or a styled hyperlink pointing to a credential-harvesting site. When the victim's Thunderbird renders the message, the injected content is displayed within the legitimate chat UI, making the phishing lure visually indistinguishable from authentic application chrome. No public exploit code has been identified at time of analysis.