| CVE-2026-14899 | HOCH7.5 | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thu | 22/07/2026 |
| CVE-2026-16410 | KRITISCH9.8 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16409 | HOCH7.5 | Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16407 | KRITISCH9.8 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16403 | MITTEL6.5 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16402 | KRITISCH9.8 | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16401 | HOCH8.8 | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16400 | HOCH7.5 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16399 | HOCH7.5 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16398 | HOCH7.5 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16396 | HOCH8.8 | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16393 | KRITISCH9.1 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16392 | KRITISCH9.1 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16391 | HOCH7.5 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16390 | KRITISCH9.1 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16389 | KRITISCH9.8 | Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16388 | KRITISCH9.8 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16387 | KRITISCH9.8 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16386 | HOCH7.5 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16385 | HOCH7.5 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |