Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 26

• Critical 9.2
  CVE-2026-111497 Exploited Public exploit EPSS 83%

  Out-of-Bounds Write in Google Brotli Decoder

  A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

  Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
  Oct 22, 2026

  KEV Oct 27, 2026
• Critical 9.8
  CVE-2026-6748

  Uninitialized memory in the Audio/Video: Web Codecs component

  Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Critical 9.8
  CVE-2026-6771

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 8.8
  CVE-2026-6750

  Privilege escalation in the Graphics: WebRender component

  Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 8.8
  CVE-2026-6761

  Privilege escalation in the Networking component

  Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 8.8
  CVE-2026-6769

  Privilege escalation in the Debugger component

  Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.8
  CVE-2026-6776

  Incorrect boundary conditions in the WebRTC: Networking component

  Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6746

  Use-after-free in the DOM: Core & HTML component

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6747

  Use-after-free in the WebRTC component

  Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6749

  Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

  Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6754

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6759

  Use-after-free in the Widget: Cocoa component

  Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6766

  Incorrect boundary conditions in the Libraries component in NSS

  Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6772

  Incorrect boundary conditions in the Libraries component in NSS

  Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6785

  Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

  Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.5
  CVE-2026-6786

  Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

  Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.3
  CVE-2026-6751

  Uninitialized memory in the Audio/Video: Web Codecs component

  Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.3
  CVE-2026-6752

  Incorrect boundary conditions in the WebRTC component

  Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• High 7.3
  CVE-2026-6753

  Incorrect boundary conditions in the WebRTC component

  Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 6.5
  CVE-2026-6763

  Mitigation bypass in the File Handling component

  Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 6.5
  CVE-2026-6764

  Incorrect boundary conditions in the DOM: Device Interfaces component

  Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 6.5
  CVE-2026-6770 Public exploit

  Other issue in the Storage: IndexedDB component

  Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 6.3
  CVE-2026-6757

  Invalid pointer in the JavaScript: WebAssembly component

  Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 6.3
  CVE-2026-6762

  Spoofing issue in the DOM: Core & HTML component

  Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 5.3
  CVE-2026-6765 Public exploit

  Information disclosure in the Form Autofill component

  Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026
• Medium 5.3
  CVE-2026-6767

  Other issue in the Libraries component in NSS

  Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Apr 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460074
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460076
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460078
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460079
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460085
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460086
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460088
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460096
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460107
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460110
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460112
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19461.json
• report
  https://access.redhat.com/security/cve/CVE-2026-6746
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6746
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6746
• article
  https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6746
• article
  https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6746
• report
  https://access.redhat.com/security/cve/CVE-2026-6747
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6747
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6747
• article
  https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6747
• article
  https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6747
• report
  https://access.redhat.com/security/cve/CVE-2026-6748
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6748