CVE-2022-3033

What it actually does

A crafted HTML email with a meta refresh tag bypasses remote content blocking and allows JavaScript execution inside the message compose document, enabling read and modification of quoted message content including decrypted plaintext.

Why it matters to the business

Attackers can exfiltrate sensitive decrypted message content from users who have not changed the default HTML display setting, leading to potential loss of confidential communications without requiring user interaction beyond replying to the email.

How an attack unfolds

An attacker sends a specially crafted HTML email containing a meta refresh tag and supporting elements; when the recipient replies, Thunderbird issues a network request and executes attacker-controlled JavaScript in the compose context, which can read the quoted original message and transmit its contents to an attacker-controlled URL.

How to fix it

Upgrade Thunderbird to version 102.2.1 or later, or 91.13.1 or later. Users who have already switched the Message Body display setting to 'simple html' or 'plain text' are not affected.

How to confirm the fix worked

Confirm the installed Thunderbird version is at least 102.2.1 or 91.13.1; verify the Message Body display preference is not set to the default HTML mode if an older version must remain in use.

Typical attack path

1. Attacker crafts HTML email with meta http-equiv refresh and supporting elements to trigger script execution on reply
2. Victim receives and opens the message in default HTML view
3. Victim initiates a reply action
4. JavaScript executes in the compose document context
5. Script extracts quoted plaintext including any decrypted content
6. Script transmits data to the attacker-specified or modified URL

How to detect it

Review Thunderbird process network connections and message compose activity logs for unexpected outbound requests triggered during reply operations; inspect incoming email headers and HTML content for meta refresh tags combined with script-capable elements.

What your security team should do

• Prioritize immediate upgrade of all Thunderbird installations to the fixed releases
• Audit email client configurations to enforce 'simple html' or 'plain text' rendering where upgrades are delayed
• Monitor for unusual outbound network requests originating from the Thunderbird compose process