CVE-2021-43528: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Mozilla Thunderbird: before 91.4.0 (fixed in 91.4.0)

Published 2021-12-08. Last modified 2026-06-17.