Description
An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | — | 140.12.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1:140.13.0esr-1 | — |
| Debian 13 | thunderbird | 1:140.13.0esr-2~deb13u1 | — |
| Debian 12 | thunderbird | 1:140.13.0esr-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | thunderbird | No fix yet | — |
| Ubuntu 26.04 LTS | thunderbird | No fix yet | — |
| Ubuntu 25.10 | thunderbird | No fix yet | — |
| Ubuntu 24.04 LTS | thunderbird | No fix yet | — |
| Ubuntu 22.04 LTS | thunderbird | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 140.12.1-1.1 | openSUSE-SU-2026:11164-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 140.13.0-1.amzn2.0.1 | ALAS2-2026-3868 |
Advisories 3
- WID-SEC-2026-2178 Mozilla Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2026
- ALAS2-2026-3868 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 17, 2026
- openSUSE-SU-2026:11164-1 MozillaThunderbird-140.12.1-1.1 on GA media SUSE / openSUSE Security Updates · Jul 2, 2026