Thunderbird 140 Patch: When FontFaceSet Crashes and YouTube Embeds Run Amok!
Security vulnerabilities fixed in Thunderbird 140 include a use-after-free in FontFaceSet and a WebCompat extension exposing a persistent UUID. While Thunderbird generally disables scripting when reading mail, these flaws pose risks in browser-like contexts. Keep your emails safe and avoid accidental YouTube binges—update now!
Hot Take:
Thunderbird 140: Where fixing security flaws is like playing a game of whack-a-mole, but with a lot more acronyms and a lot less fun! Grab your tinfoil hats, email enthusiasts, because Mozilla is serving up a piping hot platter of security patches that you’d better not ignore. After all, who knew your beloved email client could moonlight as a gateway to the chaos realm of cyber vulnerabilities?
Key Points:
- Thunderbird has patched multiple security vulnerabilities in version 140, with impacts ranging from high to low.
- CVE-2025-6424 involves a use-after-free vulnerability in FontFaceSet, potentially causing crashes.
- Some vulnerabilities, like CVE-2025-6425, could allow attackers to obtain persistent UUIDs across browsing modes.
- Several issues relate to security policy bypasses and incorrect URL parsing, posing moderate risks.
- Low-impact vulnerabilities include DNS leaks, WebAuthn issues, and HTTPS exceptions lacking anti-clickjacking measures.
Already a member? Log in here