# Mozilla Thunderbird ESR (ar) security updates

The latest version of Mozilla Thunderbird ESR (ar) is 153.7.0, released November 10, 2026. Patch Radar has 32 security fixes for Mozilla Thunderbird ESR (ar), closing 624 CVEs, 1 of which is being exploited. The newest security fix is Mozilla Thunderbird ESR (ar) 153.4.0, released September 30, 2026. Version 153.7.0 adds no new CVE fixes and includes all of them. 45 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/windows-app/mozilla-thunderbird-esr-ar
- Platform: Windows apps
- Vendor: Mozilla
- Latest version: 153.7.0 (Nov 10, 2026)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2026-100763](https://patchblox.com/security/data/cve/CVE-2026-100763.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100804](https://patchblox.com/security/data/cve/CVE-2026-100804.md) | Urgent | Sandbox escape due to use-after-free in the Preferences: Backend component | no-fix |
| [CVE-2026-100810](https://patchblox.com/security/data/cve/CVE-2026-100810.md) | Urgent | Other issue in the DevTools component | no-fix |
| [CVE-2026-74956](https://patchblox.com/security/data/cve/CVE-2026-74956.md) | Urgent | Same-origin policy bypass in the DOM: Service Workers component | no-fix |
| [CVE-2026-74979](https://patchblox.com/security/data/cve/CVE-2026-74979.md) | Urgent | Mitigation bypass in the Add-ons Manager component | no-fix |
| [CVE-2026-74989](https://patchblox.com/security/data/cve/CVE-2026-74989.md) | Urgent | Internally found bugs fixed in Thunderbird 154 | no-fix |
| [CVE-2026-84142](https://patchblox.com/security/data/cve/CVE-2026-84142.md) | Urgent | Internally found bugs fixed in Thunderbird 155 | no-fix |
| [CVE-2026-92034](https://patchblox.com/security/data/cve/CVE-2026-92034.md) | Urgent | Site isolation issue in the Graphics component | no-fix |
| [CVE-2026-92036](https://patchblox.com/security/data/cve/CVE-2026-92036.md) | Urgent | Incorrect boundary conditions in the Networking: HTTP component | no-fix |
| [CVE-2026-92037](https://patchblox.com/security/data/cve/CVE-2026-92037.md) | Urgent | Incorrect boundary conditions in the DOM: Animation component | no-fix |
| [CVE-2026-92050](https://patchblox.com/security/data/cve/CVE-2026-92050.md) | Urgent | Sandbox escape due to race condition in the XPConnect component | no-fix |
| [CVE-2026-92051](https://patchblox.com/security/data/cve/CVE-2026-92051.md) | Urgent | Spoofing issue due to invalid pointer in the Graphics component | no-fix |
| [CVE-2026-92061](https://patchblox.com/security/data/cve/CVE-2026-92061.md) | Urgent | Incorrect boundary conditions in the Security: Process Sandboxing component | no-fix |
| [CVE-2026-92066](https://patchblox.com/security/data/cve/CVE-2026-92066.md) | Urgent | Sandbox escape in the Profile Backup component | no-fix |
| [CVE-2026-100761](https://patchblox.com/security/data/cve/CVE-2026-100761.md) | High | Privilege escalation due to use-after-free in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100764](https://patchblox.com/security/data/cve/CVE-2026-100764.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100768](https://patchblox.com/security/data/cve/CVE-2026-100768.md) | High | Use-after-free in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100779](https://patchblox.com/security/data/cve/CVE-2026-100779.md) | High | Use-after-free in the XSLT component | no-fix |
| [CVE-2026-100780](https://patchblox.com/security/data/cve/CVE-2026-100780.md) | High | Use-after-free in the DOM: Core & HTML component | no-fix |
| [CVE-2026-100781](https://patchblox.com/security/data/cve/CVE-2026-100781.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | no-fix |
| [CVE-2026-100796](https://patchblox.com/security/data/cve/CVE-2026-100796.md) | High | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| [CVE-2026-100805](https://patchblox.com/security/data/cve/CVE-2026-100805.md) | High | Race condition, use-after-free in the Audio/Video component | no-fix |
| [CVE-2026-100813](https://patchblox.com/security/data/cve/CVE-2026-100813.md) | High | Invalid pointer in the JavaScript Engine: JIT component | no-fix |
| [CVE-2026-74937](https://patchblox.com/security/data/cve/CVE-2026-74937.md) | High | Use-after-free in the JavaScript: GC component | no-fix |
| [CVE-2026-74938](https://patchblox.com/security/data/cve/CVE-2026-74938.md) | High | Mitigation bypass in the JavaScript: GC component | no-fix |
| [CVE-2026-74947](https://patchblox.com/security/data/cve/CVE-2026-74947.md) | High | Privilege escalation due to invalid pointer in the Graphics component | no-fix |
| [CVE-2026-74950](https://patchblox.com/security/data/cve/CVE-2026-74950.md) | High | Privilege escalation in the Downloads API component | no-fix |
| [CVE-2026-74952](https://patchblox.com/security/data/cve/CVE-2026-74952.md) | High | Privilege escalation in the Application Update component | no-fix |
| [CVE-2026-74954](https://patchblox.com/security/data/cve/CVE-2026-74954.md) | High | Information disclosure due to side-channel in the Storage: Cache API component | no-fix |
| [CVE-2026-74955](https://patchblox.com/security/data/cve/CVE-2026-74955.md) | High | Privilege escalation in the Request Handling component | no-fix |
| [CVE-2026-74958](https://patchblox.com/security/data/cve/CVE-2026-74958.md) | High | Information disclosure in the WebRTC component | no-fix |
| [CVE-2026-74963](https://patchblox.com/security/data/cve/CVE-2026-74963.md) | High | Same-origin policy bypass in the Networking: Cookies component | no-fix |
| [CVE-2026-74965](https://patchblox.com/security/data/cve/CVE-2026-74965.md) | High | Privilege escalation in the Shell Integration component | no-fix |
| [CVE-2026-75874](https://patchblox.com/security/data/cve/CVE-2026-75874.md) | High | Sandbox escape in the Remote Settings Client component | no-fix |
| [CVE-2026-84128](https://patchblox.com/security/data/cve/CVE-2026-84128.md) | High | Privilege escalation in the WebDriver BiDi component | no-fix |
| [CVE-2026-92040](https://patchblox.com/security/data/cve/CVE-2026-92040.md) | High | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| [CVE-2026-100793](https://patchblox.com/security/data/cve/CVE-2026-100793.md) | Routine | JIT miscompilation in the JavaScript Engine component | no-fix |
| [CVE-2026-100795](https://patchblox.com/security/data/cve/CVE-2026-100795.md) | Routine | Denial-of-service in the Networking component | no-fix |
| [CVE-2026-100799](https://patchblox.com/security/data/cve/CVE-2026-100799.md) | Routine | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100802](https://patchblox.com/security/data/cve/CVE-2026-100802.md) | Routine | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| [CVE-2026-100817](https://patchblox.com/security/data/cve/CVE-2026-100817.md) | Routine | Other issue in the JavaScript: WebAssembly component | no-fix |
| [CVE-2026-74968](https://patchblox.com/security/data/cve/CVE-2026-74968.md) | Routine | Site isolation issue in the Graphics: WebRender component | no-fix |
| [CVE-2026-84126](https://patchblox.com/security/data/cve/CVE-2026-84126.md) | Routine | Incorrect boundary conditions in the Layout: Grid component | no-fix |
| [CVE-2026-84138](https://patchblox.com/security/data/cve/CVE-2026-84138.md) | Routine | Denial-of-service in the PDF Viewer component | no-fix |
| [CVE-2026-92063](https://patchblox.com/security/data/cve/CVE-2026-92063.md) | Routine | Denial-of-service in the Audio/Video component | no-fix |

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| Mozilla Thunderbird ESR (ar) 153.7.0 (latest, includes every fix below) | Nov 10, 2026 | 153.7.0 |  |  |  |
| [Mozilla Thunderbird ESR (ar) 153.4.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-153.4.0.md) | Sep 30, 2026 | 153.4.0 | Urgent | 60 | 0 |
| [Mozilla Thunderbird ESR (ar) 153.3.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-153.3.0.md) | Sep 16, 2026 | 153.3.0 | Urgent | 66 | 0 |
| [Mozilla Thunderbird ESR (ar) 153.2.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-153.2.0.md) | Sep 1, 2026 | 153.2.0 | Urgent | 27 | 0 |
| [Mozilla Thunderbird ESR (ar) 153.1.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-153.1.0.md) | Aug 18, 2026 | 153.1.0 | Urgent | 40 | 0 |
| [Mozilla Thunderbird ESR (ar) 153.0.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-153.0.1.md) | Jul 23, 2026 | 153.0.1 | Urgent | 272 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.12.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.12.0.md) | Jun 16, 2026 | 140.12.0 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.11.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.11.0.md) | May 19, 2026 | 140.11.0 | High | 4 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.10.2](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.10.2.md) | May 8, 2026 | 140.10.2 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.10.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.10.1.md) | Apr 30, 2026 | 140.10.1 | High | 1 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.10.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.10.0.md) | Apr 21, 2026 | 140.10.0 | High | 25 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.9.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.9.1.md) | Apr 7, 2026 | 140.9.1 | High | 1 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.7.2](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.7.2.md) | Feb 16, 2026 | 140.7.2 | High | 1 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.4.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.4.0.md) | Oct 14, 2025 | 140.4.0 | High | 6 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.3.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.3.0.md) | Sep 17, 2025 | 140.3.0 | High | 5 | 0 |
| [Mozilla Thunderbird ESR (ar) 140.1.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-140.1.1.md) | Aug 5, 2025 | 140.1.1 | High | 32 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.11.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.11.1.md) | Jun 10, 2025 | 128.11.1 | High | 1 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.11.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.11.0.md) | May 27, 2025 | 128.11.0 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.10.2](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.10.2.md) | May 20, 2025 | 128.10.2 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.10.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.10.1.md) | May 14, 2025 | 128.10.1 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.10.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.10.0.md) | Apr 29, 2025 | 128.10.0 | High | 4 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.9.2](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.9.2.md) | Apr 15, 2025 | 128.9.2 | High | 3 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.9.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.9.0.md) | Apr 1, 2025 | 128.9.0 | High | 2 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.8.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.8.0.md) | Mar 5, 2025 | 128.8.0 | High | 10 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.7.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.7.0.md) | Feb 5, 2025 | 128.7.0 | Urgent | 10 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.6.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.6.0.md) | Jan 8, 2025 | 128.6.0 | High | 7 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.5.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.5.0.md) | Nov 26, 2024 | 128.5.0 | Urgent | 7 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.4.3](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.4.3.md) | Nov 13, 2024 | 128.4.3 | Routine | 1 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.4.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.4.0.md) | Oct 29, 2024 | 128.4.0 | High | 10 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.3.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.3.1.md) | Oct 10, 2024 | 128.3.1 | Patch now | 1 | 1 |
| [Mozilla Thunderbird ESR (ar) 128.3.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.3.0.md) | Oct 2, 2024 | 128.3.0 | High | 11 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.2.0](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.2.0.md) | Sep 4, 2024 | 128.2.0 | High | 6 | 0 |
| [Mozilla Thunderbird ESR (ar) 128.1.1](https://patchblox.com/security/data/fix/windows-app/mozilla.thunderbird.esr.ar-128.1.1.md) | Aug 22, 2024 | 128.1.1 | High | 1 | 0 |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.