Thunderbird 140 ESR is out now with new features, bug fixes and critical security patches

Thunderbird 140 Extended Support Release (ESR) is now available for download. This comes just days after the release of the regular Thunderbird 140.

The difference, if you're wondering, is that the ESR version is built for stability, made for businesses and schools that can't have frequent changes. It receives security patches for a year, while the main version gets new features every four weeks. This yearly update schedule helps avoid breaking how things work in large offices.

As for what's new, Thunderbird 140 ESR packs in many of the changes from past monthly releases. A nice addition is better dark mode support, which now changes the look of messages on its own and gives you a quick toggle button. Notifications have been improved with new buttons to "Mark as Read", "Delete", and "Mark as Spam" right in the alert.

When it comes to folder management, you can finally sort folders manually and control threading or sorting globally from a new dedicated "Appearance" settings section. This section now combines appearance controls that were previously scattered in the General settings.

Here's the full list of what's new:

• Implemented enterprise policy to allow granular in-app notification control.
• New mail alert now includes message disposition buttons.
• Added 'Mark as Read' and 'Delete' actions to mail notifications.
• Added 'Mark as Spam' and 'Mark as Starred' actions to mail notifications.
• Support dark reader for the message pane.
• Messages are automatically adapted to dark mode with a quick toggle in the header.
• Message filters are now available in the Folder Pane context menu.
• Added horizontal threadpane scrolling (mail.threadpane.table.horizontal_scroll).
• Implemented customizable row count for Cards View in 'Appearance' settings.
• Implemented the ability to manually sort folders in the folder pane.
• New "Appearance" Settings UI to globally control message threading/sorting order.
• Added a checkbox to select/unselect all calendars in the calendar setup wizard.
• Account Hub enabled by default for second email setup.
• Add-ons: Added support for specifying a cookieStoreId when creating a space.
• Added Thunderbird-specific loading symbol.

The collection of bug fixes is huge. It tackles frustrating issues, like how deleting an attachment from a saved .eml file would only seem to work, failing in the background without any warning.

Deeper fixes include patching a race condition during folder compaction that could cause instability, and putting a stop to the strange bug that made empty emails dated 1970-01-01 appear in some POP3 inboxes. Feed subscriptions, which were completely broken, have also been repaired.

Of course, a release would not be complete without some security fixes. The update addresses the vulnerabilities detailed in Mozilla's high-impact security advisory MFSA 2025-54.

A key vulnerability patched is CVE-2025-6424, a use-after-free memory flaw with the potential to crash the application. Another fix specific to macOS closes a loophole where the application failed to trigger a safety warning when opening ".terminal" files, a mistake that could permit malicious code to execute.

Other fixes stop info from leaking and prevent websites from getting around security rules. Updating is definitely recommended.

Thunderbird 140 ESR is available for download on Windows 10/11, Windows 7/8.1, macOS, and Linux. You can also grab the regular release from our Software page. Full release notes for 140 ESR can be found here.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of June): 2,864

RIP Matrix | Farewell my friend