CVE-2026-0818 describes a medium-severity vulnerability in Mozilla Thunderbird versions prior to 147.0.1 and 140.7.1. This flaw allows an attacker to potentially extract secret content from an inline OpenPGP decrypted message if the user explicitly requests decryption and has remote content loading enabled. The attack leverages crafted HTML/CSS in the outer email to style the decrypted content, with a CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 140.7.1CPE matchmatch criteria | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* | ||
< 147.0.1CPE matchmatch criteria | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.