CVE-2026-0818

Name: CVE-2026-0818
Creator: NVD / NIST
Published: 2026-01-28T08:16:03.113+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.3/10EPSS 0.16%

Last modified Jun 17, 2026

CVE-2026-0818 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability was fixed in Thunderbird 147.0.1 and Thunderbird 140.7.1.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS Probability

0.16%

5.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Mozilla	Thunderbird	< 140.7.1
Mozilla	Thunderbird	< 147.0.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1881530Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-07/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-08/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00005.html

Timeline

Published: Jan 28, 2026
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2026-0818?

How severe is CVE-2026-0818?

CVE-2026-0818 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.

How do I fix CVE-2026-0818?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-0818?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST