Vulnerability Instance

Security researcher Fabián Cuchietti discovered that
it was possible to bypass the restriction on JavaScript execution in mail by
embedding an <iframe> with a data: URL within a message. If the victim
replied or forwarded the mail after receiving it, quoting it "in-line"
using Thunderbird's HTML mail editor, it would run the attached script. The
running script would be restricted to the mail composition window where it could
observe and potentially modify the content of the mail before it was sent.
Scripts were not executed if the recipient merely viewed the mail, only if it
was edited as HTML. Turning off HTML composition prevented the vulnerability and
forwarding the mail "as attachment" prevented the forwarding
variant.Ateeq ur Rehman Khan of Vulnerability Labs reported
additional variants of this attack involving the use of the <object> tag
and which could be used to attach object data types such as images, audio, or
video.This affected the Thunderbird 17 branch. It was fixed in all
versions based on Gecko 23 or later. Thunderbird 24 and later are not affected
by this vulnerability.