CVE-2026-57963

MEDIUM

Mozilla Thunderbird - Chat UI Manipulation by Injection

Title source: rule

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-57963. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-57963, a client-side HTML injection vulnerability in Thunderbird's Matrix/XMPP chat functionality. The code includes placeholder logic for probing a target but lacks actual exploit implementation for injecting malicious HTML/CSS payloads.

Description

An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-57963_attacker_who_can.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-57963, a client-side HTML injection vulnerability in Thunderbird's Matrix/XMPP chat functionality. The code includes placeholder logic for probing a target but lacks actual exploit implementation for injecting malicious HTML/CSS payloads.

Classification

Stub 99%

Attack Type

Xss

Complexity

Moderate

Reliability

Theoretical

Target: Mozilla Thunderbird (Matrix/XMPP chat client)

No auth needed

Prerequisites: Attacker must be able to send HTML chat messages to the victim via Matrix or XMPP · Victim must use a vulnerable Thunderbird version with HTML rendering enabled

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →