Vulnerability · NVD

CVE-2026-0818

MEDIUM 4.3 Published on 2026-01-28

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability was fixed in Thunderbird 147.0.1 and Thunderbird 140.7.1.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS 0.16% exploit very unlikely percentile 5.5%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Mozilla Thunderbird Windows winget:Mozilla.Thunderbird

Affected <147.0.1 Fixed in 147.0.1 Latest tracked 153.0.2 patched

Vulnerable CPE configurations (2)

Vendor	Product	Platform	Versions	CPE 2.3 URI
mozilla	thunderbird All platforms (wildcard)	All platforms (wildcard)	<140.7.1	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
mozilla	thunderbird All platforms (wildcard)	All platforms (wildcard)	<147.0.1	cpe:2.3:a:mozilla:thunderbird:::::-:::*

View on NVD ↗ Advisory · www.mozilla.org