Multiple Vulnerabilities in Mozilla Thunderbird Could Allow for Arbitrary Code Execution

Multiple security vulnerabilities were disclosed in Mozilla Thunderbird (with related Firefox fixes), the most severe being a use-after-free in FontFaceSet that could enable arbitrary code execution (CVE-2025-6424) and other memory-safety fixes (CVE-2025-6436). The advisory lists several additional lower-severity issues (e.g., CSP bypass, DNS leaks, WebAuthn, Content-Disposition handling) and notes that successful exploitation could allow attackers to install programs or access and modify user data depending on account privileges.