iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Thunderbird released ESR 153.4.0 and 140.17.0 on September 30, 2026. Version 153.4.0 lists fixes for several mail, account setup, Windows authentication, and update-policy issues; 140.17.0 lists security fixes. Both releases remove RNP command-line utilities from the Thunderbird package, and Mozilla published a matching security advisory for each build.
What changed in Thunderbird ESR 153.4.0?
The Thunderbird 153.4.0 release notes list six functional fixes, a packaging change, an add-on update, and security fixes.
- Quick Filter: Ctrl+Shift+K could fail to open the Quick Filter interface.
- S/MIME: Nested signed message parts could fail to render.
- IMAP setup: Thunderbird could hang while waiting for an IMAP server greeting during account setup.
- Gmail on Windows: OAuth2 authentication could fail intermittently.
- Managed updates: The AppUpdatePin policy did not prevent updates beyond the version pinned by an administrator.
- What’s New link: The link could open Release channel notes instead of the ESR notes.
The package no longer includes RNP command-line utilities, and the built-in Thundermail add-on was updated to version 2.0.16. The release notes also list security fixes; see Mozilla Security Advisory 2026-103 for the vulnerability details.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What changed in Thunderbird ESR 140.17.0?
The 140.17.0 release notes list security fixes and the removal of RNP command-line utilities from the Thunderbird package. They do not enumerate comparable functional fixes to those listed for 153.4.0. Mozilla’s matching Security Advisory 2026-102 describes the security issues addressed.
#1 Best Overall
The 140.17.0 notes state these minimum platform requirements:
- Windows 10 or later
- macOS 10.15 or later
- Linux with GTK+ 3.14 or higher
Those requirements are stated for 140.17.0; they should not be assumed to apply to 153.4.0, whose equivalent requirements are not established by the available release-note information.
How the two ESR releases compare
| Release | Functional fixes in release notes | Shared packaging change | Security advisory |
|---|---|---|---|
| 153.4.0 | Quick Filter, nested S/MIME rendering, IMAP setup, Windows Gmail OAuth2, AppUpdatePin, and the What’s New link | RNP command-line utilities removed | MFSA 2026-103 |
| 140.17.0 | No comparable functional-fix list; notes state security fixes | RNP command-line utilities removed | MFSA 2026-102 |
What Mozilla says about the security fixes
Both advisories are dated September 30, 2026, and classify the overall impact as high, while individual vulnerabilities have varying impact labels. Mozilla says that, in general, the flaws cannot be exploited through Thunderbird email because scripting is disabled when reading mail, but they may pose risks in browser or browser-like contexts. This is Mozilla’s threat-context qualification, not a claim that either build is risk-free.
For 140.17.0, the advisory includes a heap-buffer-overflow scenario involving an email at least 2 GB in size, as well as browser-engine memory-safety, sandbox, networking, and privilege issues. The advisory assigns impact levels to individual entries; the overall high-impact label should not be read as the severity of every listed flaw.
Rank #3
- 1957 Ford Thunderbird Owners Manual User Guide Reference Operator Book Fuses
Which version context matters?
Thunderbird’s July 22, 2026 announcement introduced version 153, “Meadow,” as a new ESR based on Thunderbird 140, “Eclipse,” and improvements from the monthly release channel. It highlighted a redesigned Account Hub and native Microsoft Exchange support as version-level features, not as features first introduced by point release 153.4.0. The Mozilla Support overview of Thunderbird ESR describes ESR point releases as containing security upgrades and stability fixes, so an update can matter even when its notes do not advertise a new user-facing feature.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should you install the update?
Check Thunderbird’s update function or the official release page for the branch you use, then consult the matching release notes and advisory. The 153.4.0 notes are especially relevant if you encountered one of its listed mail or account issues, use Windows with Gmail OAuth2, or administer updates with AppUpdatePin. The security fixes apply to both branches, but each has a separate advisory; use the one matching your version.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
