Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 33

• Critical 9.8
  CVE-2026-16349

  Same-origin policy bypass in the DOM: Navigation component

  Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16350

  Incorrect boundary conditions in the Audio/Video: cubeb component

  Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16351

  Sandbox escape due to use-after-free in the DOM: Navigation component

  Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16352

  Sandbox escape due to use-after-free in the Disability Access APIs component

  Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16353

  Invalid pointer in the DOM: Bindings (WebIDL) component

  Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16355

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16356

  Sandbox escape due to use-after-free in the Disability Access APIs component

  Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16357

  Incorrect boundary conditions in the Graphics component

  Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16358

  Site isolation issue in the Graphics: WebRender component

  Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16360

  Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153

  Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixe…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16361

  Memory safety bugs fixed in Thunderbird ESR 140.13

  Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16363

  JIT miscompilation in the JavaScript: WebAssembly component

  JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16368

  Incorrect boundary conditions in the JavaScript: WebAssembly component

  Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16369

  Integer overflow in the JavaScript: WebAssembly component

  Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16375

  Site isolation issue in the Networking: HTTP component

  Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16377

  Mitigation bypass in the PDF Viewer component

  Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16383

  Mitigation bypass in the DOM: Networking component

  Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16387

  Site isolation issue in the Networking component

  Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.8
  CVE-2026-16412

  Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153

  Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixe…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.1
  CVE-2026-16359

  Incorrect boundary conditions in the Audio/Video: GMP component

  Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.1
  CVE-2026-16381

  Same-origin policy bypass in the Networking: DNS component

  Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Critical 9.1
  CVE-2026-16390

  Mitigation bypass in the Enterprise Policies component

  Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 8.8
  CVE-2026-16362

  Use-after-free in the WebRTC: Audio/Video component

  Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 8.8
  CVE-2026-16371

  Privilege escalation in the DOM: Navigation component

  Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 8.8
  CVE-2026-16379

  Privilege escalation in the DOM: Content Processes component

  Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 8.8
  CVE-2026-16396

  Privilege escalation in WebExtensions

  Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 7.5
  CVE-2026-14899

  Off-by-one out of bounds read in MIME header parser for forwarding

  The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunder…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 22, 2026
• High 7.5
  CVE-2026-16354

  Information disclosure in the Graphics: ImageLib component

  Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 7.5
  CVE-2026-16374

  Information disclosure in the Framework component in DevTools

  Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 7.5
  CVE-2026-16391

  Information disclosure in the Storage: IndexedDB component

  Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• High 7.5
  CVE-2026-16405

  Information disclosure in the Networking: WebSockets component

  Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jul 21, 2026
• Medium 5.4
  CVE-2026-15719

  Site isolation issue in the DOM: Navigation component

  We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Jul 14, 2026
• Medium 4.3
  CVE-2026-15718 Public exploit

  Invalid pointer in the JavaScript: WebAssembly component

  We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Jul 14, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499973
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499974
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503415
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503416
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503454
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503473
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503491
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503500
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503505
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503512
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503517
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506217
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53445.json
• report
  https://access.redhat.com/security/cve/CVE-2026-14899
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-14899
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-14899
• article
  https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-14899