Mozilla · Thunderbird · CVE-2021-43528
**Name of the Vulnerable Software and Affected Versions**
Thunderbird versions prior to 91.4.0
**Description**
The issue is related to Thunderbird unexpectedly enabling JavaScript in the composition area, which could be used as a stepping stone to further an attack with other vulnerabilities. The JavaScript execution context was limited to this area and did not receive chrome-level privileges. This vulnerability is associated with insecure privilege management, allowing a remote attacker to bypass JavaScript execution restrictions.
**Recommendations**
For versions prior to 91.4.0, update to version 91.4.0 or later to resolve the issue. As a temporary workaround, consider disabling JavaScript execution in the composition area until a patch is available. Restrict access to sensitive features in the composition area to minimize the risk of exploitation.