Security Vulnerabilities fixed in Thunderbird 159 — Mozilla

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

Publisherwww.mozilla.org

Article IDNo stable ID in source URL

Verified snapshot3 Nov 2026, 20:55 UTC

Linked CVEs50

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2026-117929Use-after-free in the DOM: Core & HTML component
CVE-2026-117928Same-origin policy bypass in the CSS Parsing and Computation component
CVE-2026-117921Use-after-free in the CSS Parsing and Computation component
CVE-2026-117920Use-after-free in the DOM: HTML Parser component
CVE-2026-117919Use-after-free in the DOM: Core & HTML component
CVE-2026-117918Use-after-free in the Graphics: Canvas2D component
CVE-2026-117917Invalid pointer in the Graphics: WebRender component
CVE-2026-117916Use-after-free in the XSLT component
CVE-2026-117905Use-after-free in the Audio/Video: Playback component
CVE-2026-117904Use-after-free in the JavaScript: GC component
CVE-2026-117903Use-after-free in the Audio/Video component
CVE-2026-117902Use-after-free in the Layout: Text and Fonts component
CVE-2026-117901Use-after-free in the DOM: Core & HTML component
CVE-2026-117900Use-after-free in the DOM: Editor component
CVE-2026-117940Use-after-free in the DOM: Core & HTML component
CVE-2026-117939Use-after-free in the XML component
CVE-2026-117938Use-after-free in the Layout component
CVE-2026-117937Invalid pointer in the JavaScript Engine component
CVE-2026-117936Use-after-free in the DOM: Core & HTML component
CVE-2026-117899Use-after-free in the Networking: HTTP component
CVE-2026-117898Use-after-free in the JavaScript Engine: JIT component
CVE-2026-117887Use-after-free in the DOM: Core & HTML component
CVE-2026-117886Incorrect boundary conditions in the Graphics: Text component
CVE-2026-117885Use-after-free in the Layout: Grid component
CVE-2026-117884Use-after-free in the Networking component
CVE-2026-117883Use-after-free in the DOM: HTML Parser component
CVE-2026-117882Use-after-free in the Layout component
CVE-2026-117881Use-after-free in the DOM: Core & HTML component
CVE-2026-117880Use-after-free in the XML component
CVE-2026-117927Use-after-free in the SVG component
CVE-2026-117926Incorrect boundary conditions in the SVG component
CVE-2026-117925Use-after-free in the DOM: Core & HTML component
CVE-2026-117924Use-after-free in the XSLT component
CVE-2026-117923Use-after-free in the Audio/Video component
CVE-2026-117922Use-after-free in the Networking: WebSockets component
CVE-2026-117915Incorrect boundary conditions in the Layout: Block and Inline component
CVE-2026-117914Use-after-free in the SVG component
CVE-2026-117913Use-after-free in the SVG component
CVE-2026-117912Same-origin policy bypass in the CSS Parsing and Computation component
CVE-2026-117911Use-after-free in the Audio/Video: Playback component
CVE-2026-117910Invalid pointer in the JavaScript Engine component
CVE-2026-117909Use-after-free in the JavaScript: GC component
CVE-2026-117908Use-after-free in the Graphics: ImageLib component
CVE-2026-117907Use-after-free in the Networking component
CVE-2026-117906Use-after-free in the CSS Parsing and Computation component
CVE-2026-117897Incorrect boundary conditions in the Layout: Tables component
CVE-2026-117896Use-after-free in the DOM: Core & HTML component
CVE-2026-117895Use-after-free in the DOM: Core & HTML component
CVE-2026-117894Incorrect boundary conditions in the WebRTC: Signaling component
CVE-2026-117893Incorrect boundary conditions in the Security: PSM component

Source and provenance

Original title: Security Vulnerabilities fixed in Thunderbird 159 — Mozilla. Captured 3 Nov 2026, 20:55 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗