CVE-2026-0818
📋 TL;DR
This vulnerability in Thunderbird allows attackers to exfiltrate decrypted OpenPGP email contents through CSS injection when users load remote content. It affects Thunderbird users who decrypt inline OpenPGP messages in HTML-formatted emails with remote content enabled. The risk is limited to users who have both decrypted sensitive content and allowed remote content loading.
💻 Affected Systems
- Mozilla Thunderbird
📦 What is this software?
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers successfully extract sensitive decrypted email contents including passwords, financial information, or confidential communications.
Likely Case
Targeted attacks against specific users with valuable encrypted communications, requiring both user interaction and specific configuration settings.
If Mitigated
No impact if users have disabled remote content loading or avoid decrypting sensitive messages in HTML emails.
🎯 Exploit Status
Requires user to receive crafted email, load remote content, and decrypt inline OpenPGP message. Attackers need control over CSS and fonts referenced in email.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 147.0.1 or Thunderbird 140.7.1
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2026-07/
Restart Required: Yes
Instructions:
1. Open Thunderbird. 2. Go to Help > About Thunderbird. 3. Allow automatic update or download from mozilla.org. 4. Restart Thunderbird after update.
🔧 Temporary Workarounds
Disable Remote Content
allPrevent loading of remote CSS, fonts, and images that enable the attack
In Thunderbird: Tools > Settings > Privacy & Security > untick 'Allow remote content in messages'
Use PGP/MIME Instead
allAvoid inline OpenPGP decryption in HTML emails
Configure OpenPGP to use PGP/MIME attachments instead of inline decryption
🧯 If You Can't Patch
- Disable 'Allow remote content in messages' in Thunderbird settings
- Train users to avoid decrypting sensitive OpenPGP messages in HTML-formatted emails
🔍 How to Verify
Check if Vulnerable:
Check Thunderbird version in Help > About Thunderbird. If version is below 147.0.1 (for latest) or 140.7.1 (for ESR), you are vulnerable.Check Version:
thunderbird --version (Linux) or check About dialog (Windows/macOS)Verify Fix Applied:
Confirm version is 147.0.1 or higher (or 140.7.1 or higher for ESR) in Help > About Thunderbird.📡 Detection & Monitoring
Log Indicators:
- Unusual CSS or font loading from remote sources in email clients
- Multiple failed decryption attempts on crafted emails
Network Indicators:
- Outbound requests to attacker-controlled domains when viewing emails with CSS/font references
SIEM Query:
source="thunderbird.log" AND ("remote content" OR "css load" OR "font load") AND dest_ip NOT IN [trusted_domains]