Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 22

• Critical 9.8
  CVE-2026-8094

  Other issue in the WebRTC component

  Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Wolfi
  May 7, 2026
• Critical 9.8
  CVE-2026-8401

  Sandbox escape in the Profile Backup component

  Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026
• Critical 9.8
  CVE-2026-8956

  Integer overflow in the Networking: JAR component

  Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Critical 9.6
  CVE-2026-8953

  Sandbox escape due to use-after-free in the Disability Access APIs component

  Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Critical 9.6
  CVE-2026-8959

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• Critical 9.3
  CVE-2026-8950

  Same-origin policy bypass in the Networking: HTTP component

  Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8955

  Privilege escalation in the DOM: Workers component

  Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8957

  Privilege escalation in the Enterprise Policies component

  Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8970

  Privilege escalation in the Security component

  Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8974

  Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

  Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8975

  Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

  Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.6
  CVE-2026-8958

  Information disclosure, sandbox escape in the Security: Process Sandboxing component

  Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.1
  CVE-2026-8092

  Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

  Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability wa…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 7, 2026
• High 8.1
  CVE-2026-8962

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8946

  Incorrect boundary conditions in the Audio/Video: Web Codecs component

  Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8954

  Incorrect boundary conditions, integer overflow in the Audio/Video component

  Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8968

  Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

  Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.3
  CVE-2026-8090

  Use-after-free in the DOM: Networking component

  Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 7, 2026
• High 7.3
  CVE-2026-8947

  Use-after-free in the DOM: Bindings (WebIDL) component

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Medium 6.5
  CVE-2026-8388 Public exploit

  Incorrect boundary conditions in the JavaScript Engine: JIT component

  Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026
• Medium 6.5
  CVE-2026-8961

  Spoofing issue in the Form Autofill component

  Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Medium 5.3
  CVE-2026-8391

  Other issue in the JavaScript Engine component

  Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476469
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479840
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479847
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479849
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479855
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479860
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479861
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479871
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479873
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479880
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26270.json
• report
  https://access.redhat.com/security/cve/CVE-2026-8090
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467709
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8090
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8090
• article
  https://www.mozilla.org/security/advisories/mfsa2026-41/#CVE-2026-8090
• article
  https://www.mozilla.org/security/advisories/mfsa2026-44/#CVE-2026-8090
• report
  https://access.redhat.com/security/cve/CVE-2026-8092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467708
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8092
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8092
• article
  https://www.mozilla.org/security/advisories/mfsa2026-41/#CVE-2026-8092
• article
  https://www.mozilla.org/security/advisories/mfsa2026-44/#CVE-2026-8092
• report
  https://access.redhat.com/security/cve/CVE-2026-8094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467706
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8094
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8094
• article
  https://www.mozilla.org/security/advisories/mfsa2026-41/#CVE-2026-8094
• article
  https://www.mozilla.org/security/advisories/mfsa2026-44/#CVE-2026-8094