CVE-2026-0818 CSS-based exfiltration of the content from partially encrypted emails when allowing remote content

What is CVE-2026-0818?

CVE-2026-0818 is a medium-severity vulnerability in Mozilla Thunderbird, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability was fixed in Thunderbird 147.0.1 and Thunderbird 140.7.1.

Weakness: CWE-352, CWE-200, CWE-116

Which versions are affected by CVE-2026-0818?

It affects 1 product.

Products include Mozilla Thunderbird.

How do I fix CVE-2026-0818?

Upgrade to a fixed version.

Is CVE-2026-0818 being exploited?

There is no known exploitation of CVE-2026-0818 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Thunderbird

• CVE-2026-92238 Ambiguous parsing of mail headers Critical 9.8
• CVE-2026-84637 Calendar invitation attachments could launch local executables Critical 9.8
• CVE-2021-43529 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11703 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11704 Memory corruption in Thunderbird Critical 9.8

All Mozilla Thunderbird vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-0818, DLA-4466-1, DSA-6118-1, GHSA-r27j-r277-j56h, MGASA-2026-0036, SUSE-SU-2026:0388-1 and 2 more.