What changed
On October 27, 2026, Mozilla published security fixes for Thunderbird 159 and 153.6. Both advisories carry an overall high impact rating.
One fixed issue, CVE-2026-118175, specifically concerns email. Replying to, forwarding or editing a specially crafted message as new could insert parts of another message from the same folder without a blocked-content warning. Mozilla says disclosure occurred if the user sent the composed message. This does not mean the entire mailbox was automatically leaked.
Who should check
Owners of hotels, shops and service businesses whose teams answer customers through Thunderbird on a computer. Updating Firefox does not replace checking the separate email application. This is about protecting work correspondence, not a new AI feature.
What the team can do
Our suggested checking sequence:
- Identify work computers with Thunderbird installed and assign someone to check them.
- Save unfinished drafts before restarting. Do not use real customer messages to reproduce the vulnerability.
- For a regular installation, open Help → About Thunderbird; on Mac, use Thunderbird → About Thunderbird. The official instructions say the application checks for and downloads updates, then requires a restart to install them.
- After restarting, check the version again and record the date. For managed devices, coordinate with the person responsible rather than switching update channels yourself.
Availability and limits
Official release notes confirm that 159.0 and 153.6.0esr were released on October 27. The appropriate version depends on your update channel. If Thunderbird came from a Linux distribution repository, the distribution must supply the updated package.
Mozilla cautions that many other issues in these advisories cannot be exploited by reading email because scripting is disabled there. Do not apply every browser-related risk to every email message.
The takeaway: check the email application separately from the browser. The advisory does not establish that your business was attacked; Nadali has not tested the vulnerability or inspected readers’ devices.
Author: Nadali. Prepared with AI. Sources checked October 28, 2026. Cover: a conceptual AI illustration of working with messages, not the Thunderbird interface or an incident photograph.
