CVE-2026-84144

CVE-2026-84144 describes a set of internally discovered bugs in the shared Gecko codebase, present in Thunderbird 154 and Thunderbird ESR 153.1, showing evidence of memory corruption or another security-relevant defect (CWE-119). The flaws are network-reachable but require user interaction and have high attack complexity, so exploitation is not straightforward; with enough effort, an attacker could potentially achieve high-impact effects on confidentiality, integrity, and availability, likely including code execution. Users running the affected Thunderbird releases, and the corresponding Firefox releases whose code received the same fixes, are exposed until they update. The bugs were fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to Firefox 155, Firefox ESR 153.2, Thunderbird 155, or Thunderbird 153.2 (ESR 153.2). Use software inventory or endpoint management to confirm no managed systems remain on Thunderbird 154/ESR 153.1 or pre-155 Firefox builds; no workarounds are specified, so updating is the primary mitigation.