External risk intelligence

Thunderbird XMPP Chat Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-113867

The vulnerability affects the Thunderbird email client specifically within its XMPP chat functionality. As a desktop client-side application feature, it is not an internet-facing service, gateway, or public API, and does not possess a reachable network surface common to servers or infrastructure, making public internet exposure in a deployment sense very unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Thunderbird's chat feature that uses XMPP accounts. A remote attacker could exploit this by sending a crafted request, allowing them to send messages or alter contact settings on behalf of the user without any interaction. While the issue is significant, its impact is limited to Thunderbird's specific chat functionality.

Vulnerability lets attackers send messages for users.
Impacts user data and trust in chat communications.
Confirm if XMPP chat is used; otherwise, low direct risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted XMPP message to a Thunderbird user. When the user's Thunderbird client automatically replies to this message, it will include the attacker's injected code, which is then processed by the XMPP server as if it originated from the user. This allows the attacker to perform actions on behalf of the user without their direct involvement.

Entry condition: User connected to XMPP.
Trigger point: Automatic reply to crafted message.
Resulting risk: Send messages and alter settings.

Live Threat

Current exploitation, exposure, and threat context

When Thunderbird's chat feature processes incoming XMPP requests, a remote attacker could send a specially crafted request. This could allow the attacker to inject malicious stanzas that the server then processes as if they were sent by the user, potentially enabling unauthorized message sending or changes to contact and subscription settings. This vulnerability is specific to Thunderbird's XMPP chat functionality and does not impact other features or data.

User messages and contact settings.
Malicious stanzas injected via XMPP.
Unauthorized actions on behalf of user.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, ownership of this issue likely falls to the application support team responsible for the Thunderbird email client and its XMPP functionality. The initial practical step is to identify all users and systems running the affected version of Thunderbird, confirm if XMPP chat is actively used, and then prioritize remediation based on exposure and business impact.

Application owners should manage remediation efforts.
Verify XMPP chat usage by users.
Plan for updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Thunderbird and how does it use XMPP?

Thunderbird is a desktop email client that includes an integrated chat feature supporting the XMPP protocol. XMPP is an open-standard communication technology used for instant messaging and presence information. Within Thunderbird, this allows users to connect to various chat networks directly from their email interface, acting as a client that manages sessions and exchanges messages with remote servers.

What is the vulnerability class for CVE-2026-113867?

This issue is categorized under CWE-116, which refers to Improper Encoding or Escaping of Output. In this specific case, the software fails to properly sanitize attribute values when creating outgoing data packets, known as stanzas. Because the application blindly includes received data in its replies, it inadvertently allows an attacker to inject unauthorized instructions into the communication stream.

How is this XMPP chat bug triggered?

An attacker initiates the process by sending a specially crafted request to the user. When the Thunderbird client automatically generates a reply to that message, it processes the malicious input and includes it in the outgoing stanza. This vulnerability does not trigger if the XMPP chat feature is disabled or if the client is not actively connected to an XMPP account.

Is my Thunderbird installation exposed to this risk?

According to Halo Surface Signal, this vulnerability is very unlikely to be exposed to the public internet because it exists within a client-side chat feature rather than a server or public API. The risk is primarily relevant to users who actively utilize the XMPP chat functionality within Thunderbird, as the attacker requires a path to send messages directly to that client.

How do I address this Thunderbird vulnerability?

The most effective response is to update Thunderbird to version 158.0.1, 153.5.1, or a later release that includes the fix. First, verify if your team or users actively utilize the XMPP chat feature. If the feature is not in use, the risk is significantly minimized. If it is required, prioritize scheduling the update to ensure the software correctly handles message serialization.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.