Mozilla Thunderbird Unsanitized Address Book URI Fields Vulnerability

A vulnerability exists in Mozilla Thunderbird versions prior to 128.7 and in the 134 series, where the Address Book URI fields contained unsanitized links. This flaw could allow an attacker to create and export an address book with a malicious payload embedded in a field, such as the 'Other' field in the Instant Messaging section. If another user imported this address book and clicked on the link, it could open a web page within Thunderbird that executes unprivileged JavaScript.

Impact

Exploitation of this vulnerability could lead to the execution of unprivileged JavaScript in Thunderbird.

Remediation

Users can upgrade to Thunderbird 128.7 or 135 to address this vulnerability.