CVE-2021-43528

What it actually does

The flaw unexpectedly enables JavaScript execution inside the email composition area with a restricted context that lacks chrome-level privileges but can serve as a stepping stone for chained attacks.

Why it matters to the business

Attackers may use this as an initial foothold to combine with other vulnerabilities, increasing the risk of data tampering or further system compromise in email-dependent workflows.

How an attack unfolds

An attacker sends a specially crafted message that triggers JavaScript when opened in the composition view; the limited execution context is then leveraged alongside additional vulnerabilities to expand access.

How to fix it

Upgrade Thunderbird to version 91.4.0 or newer. Apply the listed fixed versions for asterisk (1:16.28.0~dfsg-0+deb11u1) and pjproject (2.12.1-r0) where those packages are present.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases; re-test email composition with JavaScript-bearing content to verify execution is blocked.

Typical attack path

1. Deliver a malicious message to the target mailbox
2. Victim opens or previews the message triggering JavaScript in the composition area
3. Combine the restricted JS context with separate vulnerabilities to escalate privileges or achieve persistence

How to detect it

Inspect email client logs and process activity for unexpected script execution originating from message composition; correlate with follow-on privilege escalation indicators.

What your security team should do

• Apply the published fixed versions immediately given the public disclosure age and slight EPSS increase
• Review email client configurations to disable unnecessary scripting features
• Monitor for chained exploit attempts that begin with composition-area activity