CVE-2022-3033

CVE-2022-3033 is a high-severity vulnerability affecting Mozilla Thunderbird versions prior to 102.2.1 and 91.13.1. It allows an attacker to execute arbitrary JavaScript code within the context of a message compose document when a user replies to a specially crafted HTML email containing a meta refresh tag. This JavaScript could read and modify message content, including decrypted encrypted data, and transmit it to an attacker-controlled URL. The vulnerability has a CVSS score of 8.1 (High), indicating a network-based attack with low complexity, requiring user interaction, and leading to high confidentiality and integrity impacts. Users who have configured Thunderbird to display messages as 'simple html' or 'plain text' are not affected. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of vulnerabilities.