Windows apps · Mozilla
Mozilla Thunderbird ESR (sl) security updates
The latest version of Mozilla Thunderbird ESR (sl) is 153.7.0, released November 10, 2026. Patch Radar has 32 security fixes for Mozilla Thunderbird ESR (sl), closing 624 CVEs, 1 of which is being exploited. The newest security fix is Mozilla Thunderbird ESR (sl) 153.4.0, released September 30, 2026. Version 153.7.0 adds no new CVE fixes and includes all of them. 45 CVEs have no fix yet.
1 exploited CVEs45 with no fix yet
Latest version
153.7.0
Released Nov 10, 2026
Security fixes
32
On record in Patch Radar
CVEs
624
Closed by those fixes
Exploited
1
Vendor report or CISA KEV
CVEs with no fix yet
| Priority | CVE | Title | Status |
|---|---|---|---|
| Urgent | CVE-2026-100763 | Incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| Urgent | CVE-2026-100804 | Sandbox escape due to use-after-free in the Preferences: Backend component | no-fix |
| Urgent | CVE-2026-100810 | Other issue in the DevTools component | no-fix |
| Urgent | CVE-2026-74956 | Same-origin policy bypass in the DOM: Service Workers component | no-fix |
| Urgent | CVE-2026-74979 | Mitigation bypass in the Add-ons Manager component | no-fix |
| Urgent | CVE-2026-74989 | Internally found bugs fixed in Thunderbird 154 | no-fix |
| Urgent | CVE-2026-84142 | Internally found bugs fixed in Thunderbird 155 | no-fix |
| Urgent | CVE-2026-92034 | Site isolation issue in the Graphics component | no-fix |
| Urgent | CVE-2026-92036 | Incorrect boundary conditions in the Networking: HTTP component | no-fix |
| Urgent | CVE-2026-92037 | Incorrect boundary conditions in the DOM: Animation component | no-fix |
| Urgent | CVE-2026-92050 | Sandbox escape due to race condition in the XPConnect component | no-fix |
| Urgent | CVE-2026-92051 | Spoofing issue due to invalid pointer in the Graphics component | no-fix |
| Urgent | CVE-2026-92061 | Incorrect boundary conditions in the Security: Process Sandboxing component | no-fix |
| Urgent | CVE-2026-92066 | Sandbox escape in the Profile Backup component | no-fix |
| High | CVE-2026-100761 | Privilege escalation due to use-after-free in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100764 | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100768 | Use-after-free in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100779 | Use-after-free in the XSLT component | no-fix |
| High | CVE-2026-100780 | Use-after-free in the DOM: Core & HTML component | no-fix |
| High | CVE-2026-100781 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | no-fix |
| High | CVE-2026-100796 | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| High | CVE-2026-100805 | Race condition, use-after-free in the Audio/Video component | no-fix |
| High | CVE-2026-100813 | Invalid pointer in the JavaScript Engine: JIT component | no-fix |
| High | CVE-2026-74937 | Use-after-free in the JavaScript: GC component | no-fix |
| High | CVE-2026-74938 | Mitigation bypass in the JavaScript: GC component | no-fix |
| High | CVE-2026-74947 | Privilege escalation due to invalid pointer in the Graphics component | no-fix |
| High | CVE-2026-74950 | Privilege escalation in the Downloads API component | no-fix |
| High | CVE-2026-74952 | Privilege escalation in the Application Update component | no-fix |
| High | CVE-2026-74954 | Information disclosure due to side-channel in the Storage: Cache API component | no-fix |
| High | CVE-2026-74955 | Privilege escalation in the Request Handling component | no-fix |
| High | CVE-2026-74958 | Information disclosure in the WebRTC component | no-fix |
| High | CVE-2026-74963 | Same-origin policy bypass in the Networking: Cookies component | no-fix |
| High | CVE-2026-74965 | Privilege escalation in the Shell Integration component | no-fix |
| High | CVE-2026-75874 | Sandbox escape in the Remote Settings Client component | no-fix |
| High | CVE-2026-84128 | Privilege escalation in the WebDriver BiDi component | no-fix |
| High | CVE-2026-92040 | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| Routine | CVE-2026-100793 | JIT miscompilation in the JavaScript Engine component | no-fix |
| Routine | CVE-2026-100795 | Denial-of-service in the Networking component | no-fix |
| Routine | CVE-2026-100799 | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| Routine | CVE-2026-100802 | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| Routine | CVE-2026-100817 | Other issue in the JavaScript: WebAssembly component | no-fix |
| Routine | CVE-2026-74968 | Site isolation issue in the Graphics: WebRender component | no-fix |
| Routine | CVE-2026-84126 | Incorrect boundary conditions in the Layout: Grid component | no-fix |
| Routine | CVE-2026-84138 | Denial-of-service in the PDF Viewer component | no-fix |
| Routine | CVE-2026-92063 | Denial-of-service in the Audio/Video component | no-fix |
Security fixes, newest first
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.