Original message, which could potentially contain the decrypted plaintext of encrypted data To, read and modify the contents of the message compose document, including the quoted The JavaScript code was able to perform actions including, but probably not limited It was possible to execute JavaScript code included in the message in the context of the

In combination with certain other HTML elements and attributes in the email, Thunderbird started a network request to that URL, regardless of the configuration to block Having the http-equiv='refresh' attribute, and the content attribute specifying an URL, then If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag #CVE-2022-3033: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag Reporter Sarah Jamie Lewis Impact high Description

Mozilla Foundation Security Advisory 2022-39 Security Vulnerabilities fixed in Thunderbird 91.13.1 Announced SeptemImpact high Products Thunderbird Fixed in

Mozilla thunderbird 17