CVE-2026-84143

CVE-2026-84143 covers internally discovered bugs in Thunderbird 154, Thunderbird ESR 153.1, and Thunderbird ESR 140.14, some of which showed evidence of memory corruption (CWE-119) or other security-relevant defects such as information exposure (CWE-200). Per the published CVSS 9.8 rating, the flaws are network-exploitable without privileges or user interaction, and Mozilla states that with enough effort some of them could have been exploited, potentially giving an attacker a high impact on confidentiality, integrity, and availability (e.g., code execution or data disclosure). Because fixes shipped in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird ESR 140.15, and Thunderbird ESR 153.2, users of Firefox releases prior to 155 and of the named Thunderbird releases are in scope. There is no evidence of exploitation in the wild: no public proof-of-concept exists, the issue is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days (31st percentile).

What to do: Update Firefox to 155 (or Firefox ESR 140.15/153.2) and Thunderbird to 155 (or Thunderbird ESR 140.15/153.2) as soon as practical; there are no configuration workarounds for memory-corruption defects, so prioritize Thunderbird deployments that process untrusted mail. Inventory browser and mail-client versions and confirm no endpoints remain on Thunderbird 154, Thunderbird ESR 153.1, Thunderbird ESR 140.14, or Firefox releases before 155.