thunderbird-153.2.0esr

[Joe Locash]

What’s Fixed

• Deleting an Exchange account retained the outgoing server settings
• Thunderbird upgrade disabled Settings menu for versions before macOS 13
• Windows jump list menu no longer functioned correctly

Security fixes

• CVE-2026-84639: Uninitialized memory in MIME parsing (high)
• CVE-2026-84640: One byte overflow read in mail parser (medium)
• CVE-2026-84641: Information disclosure due to malicious IMAP server response (low)
• CVE-2026-84637: Calendar invitation attachments could launch local executables (low)
• CVE-2026-84642: Allowed UNC hostnames for attachments interpreted as a regular expression (low)
• CVE-2026-75874: Sandbox escape in the Remote Settings Client component (high)
• CVE-2026-84118: Use-after-free in the JavaScript: GC component (high)
• CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component (high)
• CVE-2026-84120: Use-after-free in the Audio/Video component (high)
• CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component (high)
• CVE-2026-84122: Use-after-free in the Audio/Video component (high)
• CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component (high)
• CVE-2026-84124: Use-after-free in the DOM: Core & HTML component (high)
• CVE-2026-84125: Use-after-free in the DOM: Core & HTML component (high)
• CVE-2026-74952: Privilege escalation in the Application Update component (moderate)
• CVE-2026-84129: Site isolation issue in the DOM: Navigation component (moderate)
• CVE-2026-84130: Information disclosure in the Graphics: WebGPU component (moderate)
• CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component (moderate)
• CVE-2026-84132: Information disclosure in the Networking: HTTP component (moderate)
• CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component (low)
• CVE-2026-84134: Other issue in the Profile Backup component (low)
• CVE-2026-84136: Other issue in the DOM: Navigation component (low)
• CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component (low)
• CVE-2026-84139: Clickjacking issue in the DOM: Events component (low)
• CVE-2026-84140: Site isolation issue in the DOM: Navigation component (low)
• CVE-2026-84141: Integer overflow in the Graphics: ImageLib component (low)
• CVE-2026-84143: Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 (high)
• CVE-2026-84144: Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2 (high)
• CVE-2026-84145: Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 (high)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-88/

[Joe Locash]

Fixed at 3e584bc31c. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.0-209 has been issued.