CVE-2026-3889: Mozilla Thunderbird

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Affected products

• Mozilla Thunderbird: before 140.9.0 (fixed in 140.9.0); before 149.0 (fixed in 149.0)

Published 2026-03-24. Last modified 2026-06-17.