Mozilla released Thunderbird Desktop 157.0 on September 30, 2026, with two new enterprise policies, configuration and OpenPGP changes, and fixes across mail, sign-in, address-book and calendar workflows. Thunderbird 157.0.1 followed on October 1 with a separate fix for a crash involving EWS/Graph messages, so it is the latest point release covered here.
Thunderbird 157.0 at a glance
Thunderbird 157.0 is a desktop release dated September 30, 2026. Mozilla’s 157.0 release notes describe enterprise controls, several behavior and configuration changes, and fixes throughout the email client. The follow-up 157.0.1 release notes are dated October 1, 2026.
As an Amazon Associate I earn from qualifying purchases.
| Version | Release date | What it addresses |
|---|---|---|
| 157.0 | September 30, 2026 | New enterprise policies, other changes, and fixes across mail, authentication, OpenPGP, address book, calendar, visual/UX and security areas; see Mozilla’s 157.0 release notes. |
| 157.0.1 | October 1, 2026 | A crash when handling EWS/Graph messages containing relative URL fragments; see Mozilla’s 157.0.1 release notes. |
What changed in Thunderbird 157.0?
New controls for administrators
Two enterprise policies were added: DisableChat disables Thunderbird Chat, while DisableFileLink disables Thunderbird FileLink. These are administrative controls for organizations managing Thunderbird deployments.
Configuration, OpenPGP and bundled tools
- The
mailnews.headers.minNumHeaderspreference was removed. - Remote content is now allowed in OpenPGP messages encrypted with integrity protection.
- RNP command-line utilities are no longer bundled with Thunderbird.
- The port field is optional when manually configuring an IMAP or POP account.
- The built-in Thundermail add-on was updated to version 2.0.16. Mozilla Support’s New in Thunderbird Desktop page also summarizes Thundermail add-on improvements.
What Thunderbird 157.0 fixed
The fixes below are described in Mozilla’s release notes; they identify issues addressed by the release, not problems every user necessarily encountered.
Mail lists, message handling and filters
- Ctrl+Shift+K could fail to open Quick Filter, and the message list could show the wrong sender.
- The status bar could remain active after work had ended and cause 100% CPU usage. This is the symptom in the release-note description, not a measurement of how many users experienced it.
- Sent messages could fail to save silently in an IMAP Sent folder. Pending moves within the same IMAP account could make messages disappear, and malformed References headers could prevent graceful handling.
- Message filters could report a match after a search-term failure.
- Yahoo email could appear blank when MIME handlers were disabled, and inline images could disappear after editing and saving a draft.
Account setup and authentication
- Account setup could hang while waiting for an IMAP server greeting or fail because of a malformed URI.
- A custom OAuth endpoint host could incorrectly be required in full-URL form rather than as a domain.
- Authentication fixes address large SMTP OAuth2 access tokens, intermittent Gmail OAuth2 failures on Windows, updated Exchange NTLM passwords not being saved, and SMTP AUTH LOGIN closing the connection after username challenges.
OpenPGP, contacts and calendars
- OpenPGP replacement-key discovery could fail after key revocation, and valid RSA OpenPGP keys could be rejected, preventing encryption.
- CardDAV synchronization could fail when no password prompt was needed.
- Recurring calendar events could appear beyond their configured end dates. CalDAV task bodies could remain outdated after another client synchronized changes, and invitations could be accepted before the calendar had synchronized.
Mozilla also lists visual/UX improvements and security fixes, without enumerating those changes in the concise issue list on the 157.0 release-notes page.
What the security notice says
Mozilla Foundation Security Advisory 2026-101, announced September 30, 2026, says vulnerabilities were fixed in Thunderbird 157 and labels the advisory impact “high.” Mozilla qualifies the risk this way: “In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.” That does not mean the vulnerabilities are harmless; the affected context matters.
The advisory includes CVE-2026-103500, a heap buffer overflow Mozilla describes as potentially triggered by opening an email at least 2 GB in size; this individual issue is marked low impact. Other listed issues involve areas including playback, widgets, navigation, storage, sandboxing, WebGPU and content processes. Consult the full Mozilla advisory for each item’s description, impact and affected context.
Who should pay attention to the EWS migration notice?
Organizations using Microsoft 365 email through EWS should consult Mozilla’s October 2026 EWS-to-Graph migration notice before planning their setup. Mozilla Support singles out organizations currently using EWS to connect to Microsoft 365 accounts; this notice is not a blanket migration instruction for every Thunderbird user. See the Mozilla Support Thunderbird overview for the audience-specific notice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
