CVE-2026-84642

CVE-2026-84642 is a flaw in how Mozilla Thunderbird handles the mail.allowed_attachment_hostnames advanced configuration setting: the configured values are inserted into a regular expression without escaping. As a result, for some valid hostname values, unintended hostnames also match the pattern, so Thunderbird loads and serves remote attachments/content from hosts the user never allowed. An attacker who can point mail content at such an unintended hostname gains a confidentiality impact (per the CVSS vector, C:H/I:N/A:N), such as having remote content fetched from an unapproved host; no code execution is indicated. Only Thunderbird users who have explicitly set this non-default advanced preference are affected. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, so no exploitation is currently known.

What to do: Upgrade Thunderbird to version 155, or to 153.2 where that is the applicable update channel. As an interim check, open the Config Editor and see whether mail.allowed_attachment_hostnames is set at all; if it is not set, you are not affected. If it is set, prioritize upgrading, and review configured values for regex metacharacters that could match unintended hostnames until the update is applied.