We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
Reserved 2025-04-23 | Published 2025-05-14 | Updated 2025-05-16 | Assigner mozillaJavaScript Execution via Spoofed PDF Attachment and file:/// Link
Dario Weißer
bugzilla.mozilla.org/show_bug.cgi?id=1958376
www.mozilla.org/security/advisories/mfsa2025-34/
www.mozilla.org/security/advisories/mfsa2025-35/
Support options
