CVE-2026-0818: mozilla thunderbird Improper Encoding or Escaping of Output

Vulnerability summary

CVE-2026-0818 is a medium (CVSS 4.3) Improper Encoding or Escaping of Output vulnerability in mozilla thunderbird. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.

Timeline

1. 28-01-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability was fixed in Thunderbird 147.0.1 and Thunderbird 140.7.1.

• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.