CVE-2022-3034: Mozilla Thunderbird

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Affected products

• Mozilla Thunderbird: before 91.31.1 (fixed in 91.31.1); from 102.0, before 102.2.1 (fixed in 102.2.1)

Published 2022-12-22. Last modified 2026-06-17.