Thunderbird LDAP and Chat Message Injection Flaws

HTML injection via Matrix and XMPP chat in Mozilla Thunderbird allows remote network-accessible attackers to inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI without any authentication. All Thunderbird versions prior to 152.0.1 and 140.12.1 ESR are affected. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), but SSVC flags the attack as automatable with partial technical impact, making it a realistic phishing and UI-deception vehicle for anyone reachable via federated Matrix or XMPP.

Memory exhaustion denial-of-service in Mozilla Thunderbird's LDAP address-book autocomplete client allows a malicious or compromised LDAP server to crash the application by returning unbounded data payloads. Affected users are those explicitly configured to query an LDAP directory server for autocomplete, making this a targeted rather than opportunistic attack. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) alongside a CISA SSVC exploitation rating of 'none' confirms very low real-world urgency.