The version of Thunderbird installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR     153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124913)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-129 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-125 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 160 and Thunderbird 160. (CVE-2026-124852)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99112 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)

    * firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)

    * firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component     (CVE-2026-124917)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)

    * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)

    * firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)

    * firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text     component (CVE-2026-124853)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API     component (CVE-2026-124859)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)

    * firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)

    * firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)

    * firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124887)

    * firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)

    * firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)

    * firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component     (CVE-2026-124948)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component     (CVE-2026-124875)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)

    * firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)

    * firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)

    * firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component     (CVE-2026-124895)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)

    * firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)

    * firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)

    * firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)

    * firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)

    * firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics:
    CanvasWebGL component (CVE-2026-124907)

    * firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)

    * firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)

    * firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)

    * firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)

    * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics:
    WebRender component (CVE-2026-124918)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)

    * firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component     (CVE-2026-124919)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component     (CVE-2026-124924)

    * firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component     (CVE-2026-124902)

    * firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)

    * firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component     (CVE-2026-124864)

    * firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)

    * firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124888)

    * firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component     (CVE-2026-124861)

    * firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99111 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)

    * firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)

    * firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component     (CVE-2026-124917)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)

    * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)

    * firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)

    * firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text     component (CVE-2026-124853)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API     component (CVE-2026-124859)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)

    * firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)

    * firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)

    * firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124887)

    * firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)

    * firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)

    * firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component     (CVE-2026-124948)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component     (CVE-2026-124875)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)

    * firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)

    * firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)

    * firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component     (CVE-2026-124895)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)

    * firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)

    * firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)

    * firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)

    * firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)

    * firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics:
    CanvasWebGL component (CVE-2026-124907)

    * firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)

    * firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)

    * firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)

    * firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)

    * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics:
    WebRender component (CVE-2026-124918)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)

    * firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component     (CVE-2026-124919)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component     (CVE-2026-124924)

    * firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component     (CVE-2026-124902)

    * firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)

    * firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component     (CVE-2026-124864)

    * firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)

    * firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124888)

    * firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component     (CVE-2026-124861)

    * firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-125 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 160 and Thunderbird 160. (CVE-2026-124852)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-127 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR     153.7, and Thunderbird 160. (CVE-2026-124855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-127 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability     was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124853)

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160,     Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124854)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR     153.7, and Thunderbird 160. (CVE-2026-124855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-129 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99110 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)

    * firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)

    * firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component     (CVE-2026-124917)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)

    * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)

    * firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)

    * firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text     component (CVE-2026-124853)

    * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API     component (CVE-2026-124859)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)

    * firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)

    * firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)

    * firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124887)

    * firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)

    * firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)

    * firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)

    * firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component     (CVE-2026-124948)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component     (CVE-2026-124875)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)

    * firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)

    * firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)

    * firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component     (CVE-2026-124895)

    * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)

    * firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)

    * firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)

    * firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)

    * firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)

    * firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics:
    CanvasWebGL component (CVE-2026-124907)

    * firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)

    * firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)

    * firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)

    * firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)

    * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics:
    WebRender component (CVE-2026-124918)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)

    * firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component     (CVE-2026-124919)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component     (CVE-2026-124924)

    * firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component     (CVE-2026-124902)

    * firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)

    * firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)

    * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)

    * firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component     (CVE-2026-124864)

    * firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)

    * firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)

    * firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-124888)

    * firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component     (CVE-2026-124861)

    * firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
378427	Mozilla Thunderbird < 160.0	Nessus	Windows	11/10/2026	11/10/2026	critical
378463	Linux Distros Unpatched Vulnerability : CVE-2026-124913	Nessus	Misc.	11/10/2026	11/11/2026	high
378657	Mozilla Thunderbird < 153.7	Nessus	MacOS X Local Security Checks	11/11/2026	11/11/2026	critical
378432	Mozilla Firefox < 160.0	Nessus	Windows	11/10/2026	11/10/2026	critical
379395	RHEL 8 : firefox (RHSA-2026:99112)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical
378428	Mozilla Thunderbird < 160.0	Nessus	MacOS X Local Security Checks	11/10/2026	11/10/2026	critical
379517	RHEL 9 : firefox (RHSA-2026:99111)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical
378426	Mozilla Firefox < 160.0	Nessus	MacOS X Local Security Checks	11/10/2026	11/10/2026	critical
378430	Mozilla Firefox ESR < 153.7	Nessus	MacOS X Local Security Checks	11/10/2026	11/10/2026	critical
378433	Mozilla Firefox ESR < 153.7	Nessus	Windows	11/10/2026	11/10/2026	critical
378656	Mozilla Thunderbird < 153.7	Nessus	Windows	11/11/2026	11/11/2026	critical
379513	RHEL 9 : firefox (RHSA-2026:99110)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical