Mozilla Thunderbird 68.2.2

Here are recurring questions and related user issues:

1. Has Thunderbird experienced any major security vulnerabilities?

Yes, Thunderbird has experienced several significant security vulnerabilities over the years. Like its sibling Firefox, Thunderbird shares parts of its codebase and has inherited similar flaws. One notable vulnerability occurred in 2020 with version 68.10.0, which patched multiple high-severity issues that could allow attackers to execute arbitrary code or spoof content through crafted emails. These flaws were cataloged under multiple CVEs, such as CVE-2020-12417 and CVE-2020-12418. Mozilla regularly publishes advisories on Thunderbird updates, emphasizing the need to keep the application up to date.
Mozilla Security Advisories

2. Is Thunderbird susceptible to phishing or spoofed emails?

Yes, like all email clients, Thunderbird can display phishing or spoofed messages if users are not cautious. In the past, vulnerabilities in how email headers or HTML content were rendered allowed for spoofing sender identities or disguising malicious links. Although these specific vulnerabilities have been addressed, the broader phishing risk remains due to how easily HTML emails can be manipulated. Thunderbird includes features to warn users about potentially deceptive content, but user awareness remains critical.
Thunderbird Phishing Prevention Guide

3. Have there been any issues with encrypted email handling in Thunderbird?

Yes, users have reported issues with Thunderbird’s PGP and S/MIME encryption features, especially after version 78 introduced integrated OpenPGP support. Some bugs affected the display of encrypted content or caused key management problems. For example, users noted that messages would fail to decrypt properly, or keys would not import correctly. Mozilla has since improved these systems with updates, but configuration and compatibility problems can still occur, particularly with older key formats.
Bugzilla Thread on OpenPGP Issues

4. Has Thunderbird ever been flagged as a risk by antivirus or security tools?

There have been isolated incidents where certain antivirus tools flagged Thunderbird or its components as suspicious. In some cases, this was due to false positives triggered by email attachments or temporary files used during scanning or encryption. These alerts were typically resolved in later antivirus definition updates. However, the incidents highlight the need to monitor for legitimate threats and ensure that Thunderbird and your antivirus software are both current.
Example Discussion on Thunderbird & AV Conflicts

5. Are there known risks associated with Thunderbird extensions?

Yes, extensions can introduce risks if they are outdated, poorly maintained, or granted excessive permissions. While Thunderbird now follows a more secure WebExtension model similar to Firefox, some older or legacy extensions may still exist in use and can pose compatibility or security concerns. Users are encouraged to only install extensions from the official Thunderbird Add-ons website and to review the permissions requested by each add-on carefully.
Thunderbird Add-ons Site

6. How can users ensure the safe use of Thunderbird?

To use Thunderbird securely, users should follow several best practices:

• Always update Thunderbird to the latest version to receive security patches.
• Enable phishing and scam detection warnings in settings.
• Use strong, unique passwords for all connected email accounts.
• Configure encryption options using OpenPGP or S/MIME when handling sensitive emails.
• Avoid installing unofficial or deprecated extensions.
• Regularly back up profile data to recover from corruption or data loss.

Following these practices can significantly reduce the risk of compromise while using Thunderbird.