CVE-2022-1834

What it actually does

Improper rendering of sender display names containing repeated Braille Pattern Blank characters allows a signed email to appear as originating from an arbitrary address while the signature validation still succeeds against the hidden real address.

Why it matters to the business

Users may be tricked into trusting and acting on messages that appear to come from legitimate or familiar senders, increasing the risk of phishing or social-engineering success within the organization.

How an attack unfolds

An attacker creates an email whose visible From name begins with a false address followed by many invisible Braille space characters, appends their own signing key or certificate, and sends the message. Thunderbird strips the trailing invisible characters during display and signature comparison, showing the message as validly signed from the attacker-chosen address.

How to fix it

Upgrade Mozilla Thunderbird to version 91.10 or later on all affected systems. After upgrade, re-verify that previously imported signing keys still function as expected.

How to confirm the fix worked

Confirm installed Thunderbird version is 91.10 or newer via the Help > About dialog; optionally send a test message containing Braille Pattern Blank characters in the sender name and verify the hidden address is now shown.

Typical attack path

1. Attacker obtains or generates a signing key/certificate accepted by the target
2. Attacker crafts a sender display name containing a false address plus repeated Braille Pattern Blank characters
3. Attacker signs the message with the key
4. Attacker delivers the message to the victim Thunderbird client
5. Thunderbird renders the visible sender as the false address and reports the signature as valid

How to detect it

Because the vulnerability is a client-side display issue with no persistent artifacts, post-exploitation detection relies on user reports of unexpected but apparently valid signed messages; examine mail logs or message headers for From addresses that contain unusual Unicode blocks or repeated space-like characters.

What your security team should do

• Immediately schedule deployment of Thunderbird 91.10 or newer across the environment
• Review and enforce automatic update policies for Thunderbird
• Educate users on the risk of relying solely on displayed sender names even when signatures appear valid
• Monitor vendor advisories for any subsequent Thunderbird signing or display fixes