Skip to main content

Mozilla Thunderbird CVE-2026-57963

| EUVDEUVD-2026-40862 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-01 mozilla GHSA-396p-jm6v-v2p3
XSS Mozilla Thunderbird Red Hat Suse
6.5
CVSS 3.1 · Vendor: mozilla
Share

Severity by source

Vendor (mozilla) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Federation allows network delivery with no privileges; passive message rendering justifies UI:N; impact capped at Low as no code execution or data exfiltration beyond phishing is implied.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 18:47 vuln.today
CVE Published
Jul 01, 2026 - 00:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

AnalysisAI

HTML injection via Matrix and XMPP chat in Mozilla Thunderbird allows remote network-accessible attackers to inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI without any authentication. All Thunderbird versions prior to 152.0.1 and 140.12.1 ESR are affected. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), but SSVC flags the attack as automatable with partial technical impact, making it a realistic phishing and UI-deception vehicle for anyone reachable via federated Matrix or XMPP.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) defect in Thunderbird's built-in chat renderer, which processes messages delivered over the Matrix and XMPP protocols. The chat component accepts attacker-controlled HTML and CSS without adequate sanitization, allowing content to be rendered in the Thunderbird chat panel. The affected CPE is cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*, covering all releases of the application (Mozilla edition) across all platforms prior to the fixed versions. Because both Matrix and XMPP are federated protocols, an attacker does not need an account on the victim's homeserver - they can operate from any server that federates with the target, lowering the barrier to reach victims.

RemediationAI

Vendor-released patches are available: upgrade to Thunderbird 152.0.1 or Thunderbird 140.12.1 (ESR), as confirmed by Mozilla advisories at https://www.mozilla.org/security/advisories/mfsa2026-62/, https://www.mozilla.org/security/advisories/mfsa2026-63/, and https://www.mozilla.org/security/advisories/mfsa2026-64/. For organizations unable to patch immediately, the most targeted workaround is to disable Thunderbird's integrated chat feature entirely (via Preferences > Chat), which eliminates the attack surface without affecting email functionality. Alternatively, restricting XMPP/Matrix server federation policies on the server side to trusted servers only reduces the attacker pool but requires server-side control and does not protect against insider threats. HTML rendering restrictions in chat clients are not user-configurable in Thunderbird, so server-side or feature-disable approaches are the only interim controls.

More in Thunderbird

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2022-26485 HIGH POC
8.8 Dec 22

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-57963 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy