CVE-2026-0818: 
NixOS vulnerability analysis and mitigation

CVE-2026-0818 is a CSS-based information disclosure vulnerability in Mozilla Thunderbird that allows a crafted email to exfiltrate the decrypted contents of inline OpenPGP-encrypted messages. When a user manually decrypts an inline OpenPGP message embedded within an HTML/CSS-styled email and has remote content loading enabled, the decrypted text is rendered under the outer email's CSS context, enabling a malicious sender to extract secret content via CSS rules, fonts, and animations. The vulnerability affects Thunderbird versions prior to 147.0.1 (standard release) and prior to 140.7.1 (ESR). It was disclosed on January 27, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Mozilla Advisory mfsa2026-07, Mozilla Advisory mfsa2026-08).

The root cause is improper output encoding/escaping (CWE-116) combined with exposure of sensitive information to an unauthorized actor (CWE-200): when Thunderbird decrypts an inline OpenPGP message embedded in an HTML email's text section, it renders the plaintext within the rendering context of the outer HTML/CSS email rather than an isolated context. This allows CSS styles, custom fonts, and animations defined in the outer email to interact with the decrypted content. If the victim has also permitted remote content loading for that email, the attacker-controlled CSS can use timing side-channels or font-loading techniques to exfiltrate the decrypted text character by character to an attacker-controlled server. Two preconditions must be met: the user must explicitly trigger decryption of the embedded OpenPGP message, and remote content loading must be enabled for that email (Mozilla Advisory mfsa2026-07, Mozilla Advisory mfsa2026-08). The vulnerability was reported by researchers Leon Trampert, Daniel Weber, Christian Rossow, and Michael Schwarz.

Successful exploitation results in a confidentiality breach: the plaintext content of a decrypted OpenPGP-encrypted email can be silently exfiltrated to an attacker-controlled server without the victim's knowledge. There is no integrity or availability impact. The attack is limited to the content of the specific email being decrypted, but this is particularly severe given that the affected messages are ones the user believed to be protected by end-to-end encryption, undermining the core security guarantee of OpenPGP email encryption (Mozilla Advisory mfsa2026-07, Mozilla Advisory mfsa2026-08).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires two specific user actions (manual decryption trigger and remote content loading enabled), which significantly limits the attack surface (Mozilla Advisory mfsa2026-07).

1. Craft the malicious email: The attacker composes an HTML/CSS-formatted email that embeds an inline OpenPGP-encrypted message (containing the target's secret content) within a text section. The outer email includes attacker-controlled CSS rules, custom web fonts, and animations designed to exfiltrate text content via CSS-based side-channels (e.g., font-face unicode-range tricks or scroll-to-text timing attacks).
2. Include remote content references: The outer email references attacker-controlled remote resources (images, fonts, stylesheets) so that when the victim allows remote content, the attacker's server receives HTTP requests that encode the exfiltrated data.
3. Send the email to the target: The attacker sends the crafted email to a Thunderbird user who possesses the OpenPGP private key needed to decrypt the embedded message.
4. Wait for victim interaction: The victim opens the email and explicitly clicks to decrypt the embedded inline OpenPGP message. The victim must also have remote content loading enabled (or approve it for this message).
5. CSS exfiltration executes: Thunderbird renders the decrypted plaintext within the outer email's CSS context. The attacker's CSS rules interact with the decrypted text, triggering HTTP requests to the attacker's server that encode the secret content character by character.
6. Collect exfiltrated data: The attacker monitors their server logs to reconstruct the decrypted email content from the encoded HTTP requests (Mozilla Advisory mfsa2026-07, Mozilla Advisory mfsa2026-08).

• Network: Outbound HTTP/HTTPS requests from Thunderbird to unexpected external domains immediately after a user decrypts an inline OpenPGP message, particularly requests with URL paths or parameters that appear to encode text fragments or character sequences.
• Network: Requests to attacker-controlled font or image servers with query strings or path components that correspond to portions of email content (e.g., /exfil?c=S, /font/H.woff2).
• Logs: Thunderbird network activity logs showing remote content loaded from domains not associated with the email sender's organization at the time of OpenPGP decryption.
• Behavior: Unusual pattern of many small, rapid HTTP requests to the same external domain triggered shortly after manual decryption of an OpenPGP-encrypted email with remote content loading enabled.

Mozilla has released patched versions addressing this vulnerability: Thunderbird 147.0.1 (standard release) and Thunderbird 140.7.1 (ESR). Users should update immediately to one of these versions. As a workaround prior to patching, users should disable remote content loading in Thunderbird (Settings → Privacy & Security → uncheck "Allow remote content in messages") and avoid manually decrypting inline OpenPGP messages in HTML-formatted emails from untrusted senders. Downstream Linux distributions including Debian, SUSE, Mageia, and Amazon Linux 2 have also released updated packages (Mozilla Advisory mfsa2026-07, Mozilla Advisory mfsa2026-08).

The vulnerability was reported by academic researchers Leon Trampert, Daniel Weber, Christian Rossow, and Michael Schwarz, suggesting it originated from security research rather than opportunistic discovery. Mozilla rated the impact as "moderate" in both advisories. The vulnerability received coverage in The Hacker News weekly recap and threat landscape digests, and was picked up by multiple Linux distribution security teams (Debian, SUSE, Mageia, Amazon Linux 2) who issued downstream advisories. Community reaction has been measured given the moderate severity and the multiple preconditions required for exploitation (Mozilla Advisory mfsa2026-07, The Hacker News).