CVE-2004-2226: Mozilla Thunderbird

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Mozilla Mail 1.7.1 and 1.7.3, and Thunderbird before 0.9, when HTML-Mails is enabled, allows remote attackers to determine valid e-mail addresses via an HTML e-mail that references a Cascading Style Sheets (CSS) document on the attacker's server.

Affected products

• Mozilla Thunderbird: version 0.8 only; version 1.7.1 only; version 1.7.3 only

Published 2004-12-31. Last modified 2026-06-16.