Red Hat Security Advisory: thunderbird security update

Fixed packages 9

Vulnerabilities 38

• Critical 10.0
  CVE-2026-2760

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 10.0
  CVE-2026-2761

  Sandbox escape in the Graphics: WebRender component

  Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 10.0
  CVE-2026-2768

  Sandbox escape in the Storage: IndexedDB component

  Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 10.0
  CVE-2026-2776

  Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

  Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 10.0
  CVE-2026-2778

  Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

  Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2757

  Incorrect boundary conditions in the WebRTC: Audio/Video component

  Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2758

  Use-after-free in the JavaScript: GC component

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2759

  Incorrect boundary conditions in the Graphics: ImageLib component

  Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2762

  Integer overflow in the JavaScript: Standard Library component

  Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2763 Public exploit

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2764 Public exploit

  JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

  JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2765

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2766 Public exploit

  Use-after-free in the JavaScript Engine: JIT component

  Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2771

  Undefined behavior in the DOM: Core & HTML component

  Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2773

  Incorrect boundary conditions in the Web Audio component

  Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2775

  Mitigation bypass in the DOM: HTML Parser component

  Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2777

  Privilege escalation in the Messaging System component

  Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2779

  Incorrect boundary conditions in the Networking: JAR component

  Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2784

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2788

  Incorrect boundary conditions in the Audio/Video: GMP component

  Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2791

  Mitigation bypass in the Networking: Cache component

  Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2792

  Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

  Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Critical 9.8
  CVE-2026-2793

  Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

  Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2447

  Heap buffer overflow in libvpx

  Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 16, 2026
• High 8.8
  CVE-2026-2767

  Use-after-free in the JavaScript: WebAssembly component

  Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2769

  Use-after-free in the Storage: IndexedDB component

  Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2770

  Use-after-free in the DOM: Bindings (WebIDL) component

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2772

  Use-after-free in the Audio/Video: Playback component

  Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2774

  Integer overflow in the Audio/Video component

  Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2780

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2781

  Integer overflow in the Libraries component in NSS

  Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2782

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2785

  Invalid pointer in the JavaScript Engine component

  Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2786

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2787

  Use-after-free in the DOM: Window and Location component

  Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2789

  Use-after-free in the Graphics: ImageLib component

  Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• High 8.8
  CVE-2026-2790

  Same-origin policy bypass in the Networking: JAR component

  Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026
• Medium 6.5
  CVE-2026-2783

  Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

  Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442284
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442288
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442292
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442294
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442300
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442302
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442304
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442307
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442312
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442313
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442314
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442316
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442319
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442322
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442328
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442335
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442343