CVE-2026-0818 in Thunderbird
Summary
by MITRE • 01/28/2026
When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability affects Thunderbird < 147.0.1 and Thunderbird < 140.7.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/01/2026
This vulnerability represents a sophisticated cross-site scripting (XSS) attack vector that exploits the interaction between email client security boundaries and HTML/CSS rendering mechanisms. The flaw occurs specifically when Thunderbird processes inline OpenPGP encrypted messages that are embedded within HTML-formatted email content. The vulnerability arises from the improper isolation of decrypted content from the surrounding HTML context, allowing CSS styling from the outer email message to influence how the decrypted text is displayed. This represents a classic case of insecure output handling where the security boundary between encrypted content and its rendering environment is compromised.
The technical execution of this vulnerability requires multiple conditions to be met simultaneously. First, the user must explicitly request decryption of an inline OpenPGP message, which triggers the vulnerable code path. Second, the outer email must contain HTML styling information including CSS rules, fonts, and potentially animations. Third, the user must have enabled remote content loading, which allows the attacker to inject malicious styling rules. The attacker crafts the outer email with CSS properties such as font-family, color, and potentially CSS animations that can be used to infer or extract the decrypted content through careful observation of rendering differences. This vulnerability is categorized under CWE-79 as a Cross-Site Scripting weakness, specifically involving the improper handling of untrusted data in web contexts.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks. An attacker could craft emails that, when decrypted, reveal hidden content through CSS-based techniques such as font rendering differences, color manipulation, or timing variations. The vulnerability affects multiple Thunderbird versions including those below 147.0.1 and 140.7.1, indicating it has been present for an extended period. This represents a significant risk to users who regularly decrypt OpenPGP messages and have remote content loading enabled, as it allows for passive information extraction without requiring any active user interaction beyond the decryption request itself. The attack vector aligns with ATT&CK technique T1566.001 for credential access through spearphishing attachments, though it operates through a different mechanism.
The mitigation strategy focuses on addressing the core rendering isolation issue by ensuring that decrypted content is rendered in a completely isolated context that cannot be influenced by external CSS styles from the outer email. This requires implementing strict sandboxing of decrypted content within a separate document context that does not inherit styling properties from the parent document. Users should disable remote content loading by default and only enable it for trusted senders. Security updates should enforce proper content isolation between encrypted and decrypted contexts, implementing CSS reset mechanisms that strip all external styling influence from the decrypted message rendering process. Organizations should consider implementing email security policies that restrict automatic decryption of potentially malicious content and educate users about the risks of enabling remote content loading for untrusted sources.