Mozilla Thunderbird up to 140.7.0/147.0.0 CSS information disclosure

Summaryinfo

A vulnerability was found in Mozilla Thunderbird up to 140.7.0/147.0.0. It has been declared as problematic. Affected is an unknown function of the component CSS Handler. The manipulation results in information disclosure. This vulnerability was named CVE-2026-0818. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Mozilla Thunderbird up to 140.7.0/147.0.0. Affected is some unknown processing of the component CSS Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability affects Thunderbird < 147.0.1 and Thunderbird < 140.7.1.

The advisory is shared for download at bugzilla.mozilla.org. This vulnerability is traded as CVE-2026-0818 since 01/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/01/2026). The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 297038 (Linux Distros Unpatched Vulnerability : CVE-2026-0818), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 140.7.1 or 147.0.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (297038), EUVD (EUVD-2026-4880) and CERT Bund (WID-SEC-2026-0230). Once again VulDB remains the best source for vulnerability data.

Affected

• Mozilla Thunderbird

Productinfo

Type

• Mail Client Software

Vendor

• Mozilla

Name

• Thunderbird

Version

• 140.0
• 140.1
• 140.2
• 140.3
• 140.4
• 140.5
• 140.6
• 140.7.0
• 147.0

License

• open-source

Website

• Vendor: https://www.mozilla.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion