CVE-2026-57963

Chat UI manipulation by injection

Medium · published July 1, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Published
2026-07-01T00:58Z
EPSS history
Timeline
  • 01 JUL 00:58Z
    Chat UI manipulation by injection
    cvelistv5