Back to overview

CVE-2026-57963

Description

An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

Metadata

CVE ID: CVE-2026-57963
State: PUBLISHED
Assigner: mozilla
Reserved: 2026-06-26 15:27 UTC
Published: 2026-07-01 00:58 UTC
Last updated: 2026-07-01 00:58 UTC
Vendor / Product: Mozilla / Thunderbird
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Mozilla	Thunderbird	—	140.12.1 ≤ 140., 152.0.1 ≤

References (3)

Back to overview