{"schemaVersion":3,"id":"CVE-2026-0818","aliases":["MGASA-2026-0036","SUSE-SU-2026:0388-1","UBUNTU-CVE-2026-0818","DEBIAN-CVE-2026-0818","DLA-4466-1","DSA-6118-1","openSUSE-SU-2026:10128-1"],"status":"published","duplicateOf":null,"title":null,"description":"When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability was fixed in Thunderbird 147.0.1 and Thunderbird 140.7.1.","dates":{"published":"2026-01-28T07:39:17.467Z","modified":"2026-04-13T13:52:14.777Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":7.2,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":7.2,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0018,"percentile":0.07073,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.014999999999999996,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00165},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00161,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00161,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0018,"percentile":0.07073}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0018,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0018,"percentile":0.07073}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output","description":"The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/116.html"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"debian","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/thunderbird","purlType":"deb","versions":[{"text":"< 1:140.7.1esr-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:140.7.1esr-1~deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:140.7.1esr-1~deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:140.7.1esr-1~deb11u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:140.7.1esr-1 | < 1:140.7.1esr-1~deb12u1 | < 1:140.7.1esr-1~deb13u1 | < 1:140.7.1esr-1~deb11u1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:140.7.1+build1-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:140.7.1+build1-0ubuntu0.22.04.1","eol":null,"hubHref":null},{"vendor":"mageia","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird","purlType":"rpm","versions":[{"text":"< 140.7.1-1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-1.mga9","eol":null,"hubHref":null},{"vendor":"mageia","product":"thunderbird-l10n","name":"thunderbird-l10n","label":"thunderbird-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/thunderbird-l10n","purlType":"rpm","versions":[{"text":"< 140.7.1-1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-1.mga9","eol":null,"hubHref":null},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 140.7.1","noFixRecorded":false,"fixedIn":null},{"text":"< 147.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1 | < 147.0.1","eol":null,"hubHref":"/vendor/mozilla/thunderbird"},{"vendor":"opensuse","product":"MozillaThunderbird&distro=openSUSE Leap 15.6","name":"MozillaThunderbird","label":"MozillaThunderbird&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 140.7.1-150200.8.254.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-150200.8.254.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"MozillaThunderbird&distro=openSUSE Tumbleweed","name":"MozillaThunderbird","label":"MozillaThunderbird&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 140.7.1-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaThunderbird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"MozillaThunderbird","label":"MozillaThunderbird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 140.7.1-150200.8.254.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-150200.8.254.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","name":"MozillaThunderbird","label":"MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","purlType":"rpm","versions":[{"text":"< 140.7.1-150200.8.254.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.7.1-150200.8.254.1","eol":null,"hubHref":null}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1881530","label":"bugzilla.mozilla.org/show_bug.cgi?id=1881530","hostname":"bugzilla.mozilla.org","tags":["REPORT","Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-07/","label":"www.mozilla.org/security/advisories/mfsa2026-07/","hostname":"www.mozilla.org","tags":["REPORT","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-08/","label":"www.mozilla.org/security/advisories/mfsa2026-08/","hostname":"www.mozilla.org","tags":["REPORT","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00005.html","label":"lists.debian.org/debian-lts-announce/2026/02/msg00005.html","hostname":"lists.debian.org","tags":[]},{"url":"https://advisories.mageia.org/MGASA-2026-0036.html","label":"advisories.mageia.org/MGASA-2026-0036.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35100","label":"bugs.mageia.org/show_bug.cgi?id=35100","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.7.1esr/releasenotes/","label":"www.thunderbird.net/en-US/thunderbird/140.7.1esr/releasenotes/","hostname":"www.thunderbird.net","tags":["WEB"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-08/","label":"www.mozilla.org/en-US/security/advisories/mfsa2026-08/","hostname":"www.mozilla.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260388-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260388-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1257397","label":"bugzilla.suse.com/1257397","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0818","label":"www.suse.com/security/cve/CVE-2026-0818","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-0818","label":"ubuntu.com/security/CVE-2026-0818","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0818","label":"www.cve.org/CVERecord?id=CVE-2026-0818","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-08/#CVE-2026-0818","label":"www.mozilla.org/en-US/security/advisories/mfsa2026-08/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7991-1","label":"ubuntu.com/security/notices/USN-7991-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-0818","label":"security-tracker.debian.org/tracker/CVE-2026-0818","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:20391-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:20391-1","USN-7991-1"]},"timeline":[{"kind":"published","date":"2026-01-28T07:39:17.467Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-13T13:52:14.777Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":17,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:56:29.488Z","stale":false,"partial":false}}