CVE record · 1 source
CVE-2026-118178
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.
- Vendor
- Mozilla
- Product
- Thunderbird
- Exposure class
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed…