CVE-2022-1520

What it actually does

Thunderbird displays the encryption or digital signature status from an attached message B on the parent message A after the attachment is viewed, causing incorrect security indicators to persist on the outer message.

Why it matters to the business

Users may misjudge the authenticity or confidentiality of received messages, increasing the chance that forged or tampered email content is trusted and acted upon.

How an attack unfolds

An attacker crafts an email containing an attached signed or encrypted message, sends it to the target, and relies on the user opening the attachment; upon returning to the parent message the displayed security status now reflects the attachment instead of the actual parent message, misleading the recipient about its trustworthiness.

How to fix it

Upgrade Mozilla Thunderbird to version 91.9 or later on all endpoints; where immediate upgrade is not possible, disable message attachments or enforce manual verification of security indicators before acting on message content.

How to confirm the fix worked

Confirm installed Thunderbird version is 91.9 or newer; create test messages with signed/encrypted attachments and verify that parent message status remains independent after viewing the attachment.

Typical attack path

1. Craft email A that contains an attached encrypted or signed message B
2. Deliver email A to the victim mailbox
3. Victim opens and views the attached message B
4. Victim returns to the display of message A
5. Incorrect security status from B is shown on A, leading victim to act on false trust

How to detect it

Search Thunderbird or mail-server logs for repeated view events on messages that contain attachments; correlate with user reports of unexpected security-status changes; no persistent artifacts remain after the session ends.

What your security team should do

• Prioritize rollout of Thunderbird 91.9+ across the organization within the next patching cycle
• Update email security policies to require out-of-band verification of message authenticity
• Include this display-status issue in user awareness training on phishing and email forgery