CVE-2026-3889
Mozilla Thunderbird ≤ 140.9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-3889 is a medium-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Mozilla Thunderbird. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3889 is a spoofing vulnerability (CWE-451) affecting Mozilla Thunderbird email client. It enables user interface misrepresentation, allowing attackers to spoof critical information displayed to users. The issue was addressed in Thunderbird version 149 and Thunderbird Extended Support Release (ESR) 140.9, as detailed in Mozilla's security advisories.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it necessitates user interaction, such as clicking a malicious link or opening a crafted email. Successful exploitation results in high integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, score 6.5), potentially tricking users into performing unintended actions, such as divulging sensitive information or executing malicious content, without compromising confidentiality or availability.
Mozilla's security advisories (MFSA 2026-23 and MFSA 2026-24) and the associated Bugzilla entry (bug 2020723) confirm the fix in the specified Thunderbird versions, recommending users update immediately to mitigate the risk. No workarounds are mentioned beyond applying the patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15019
Vulnerability Data
Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.6.3 is awareness/education/training that informs people of their responsibilities and improves skills; it does not stop a UI misrepresentation weakness from remaining present or from being exploitable (e.g. in phishing).
Web filtering can block known phishing sites that exploit UI misrepresentation.
Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.
A.8.26 only requires that security requirements (including some that could indirectly relate to UI trustworthiness) be identified and specified during development; it does not itself enforce, implement, or stop UI misrepresentation from being exploitable.
Secure coding practices can prevent UI flaws that obscure or spoof critical information.
Security testing can detect UI misrepresentation vulnerabilities before deployment.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-451, a class-level weakness, and none of its children carries one either.