Mozilla shipped Thunderbird 152.0 on June 16, 2026, and underneath a quiet version number sits a release worth installing today: a privacy fix that stops signed emails from leaking your BCC list, a hardened Gmail login, one-click setup for Mozilla’s own Thundermail service, and 28 security patches. If you use the free desktop client for any account that matters, here’s what actually changed and why this is an update-now rather than an update-eventually.
What’s new in Thunderbird 152
Thunderbird 152 adds one-click setup for Thundermail accounts, switches Gmail’s OAuth login to the PKCE security extension, and lets enterprise admins enforce hardware security keys through SecurityDevices policies. It also expands mail-server hostname verification to address books and calendars, and renames account-creation buttons from “New” to “Add” for clarity.
The headline feature is convenience meeting Mozilla’s own ambitions. Thundermail, the hosted email service Mozilla put into beta in May, previously needed manual server configuration to connect; per the official release notes, 152 adds “one-click account setup for Thundermail accounts” so the client configures everything for you. The Gmail change is smaller on screen but real under the hood: Linuxiac reports Gmail OAuth now adopts PKCE, “an OAuth security extension that strengthens authorization flows” against interception. For managed fleets, SecurityDevices can now be enforced through enterprise policy.
Why this update matters for your inbox
Beyond features, 152 closes a genuine privacy leak: BCC recipients were previously included in signed email headers, exposing addresses you meant to hide. Pair that with 28 CVE fixes — 10 rated high impact — and this is a security release, not a cosmetic one.
The BCC fix is the one I’d flag for anyone who signs mail. Until now, sending a digitally signed message in Thunderbird could write your BCC’d recipients into the signed headers — meaning the very people you blind-copied could be revealed to everyone on the message. That quietly undoes the point of BCC. On the security side, Mozilla’s MFSA 2026-60 advisory lists 28 vulnerabilities fixed, including a WebRender privilege-escalation flaw (CVE-2026-12289), a DOM Workers sandbox escape (CVE-2026-12294), and a batch of memory-safety bugs Mozilla says it presumes “could have been exploited to run arbitrary code.” Exchange users get relief too — UpdateStar and the release notes both flag corrected OAuth2 failures, fixed out-of-memory errors when forwarding, and a removed Microsoft 365 deletion limit, continuing the stabilization of the native Exchange support that landed earlier this year.
How to update — and who should care most
Thunderbird auto-updates by default, so most people will get 152 without lifting a finger; to grab it now, open Help, then About Thunderbird. Anyone who signs email with OpenPGP or S/MIME, runs Gmail through Thunderbird, or manages Exchange accounts has the strongest reason to update immediately.
There’s nothing to configure for the security fixes — they apply the moment you’re on 152. I run Thunderbird alongside a couple of other clients, and the update landed silently for me; a restart from Help → About Thunderbird is all it took to confirm the version. If you sign your mail, treat the BCC fix as urgent. If you’re a heavier user weighing whether the free client still holds up against paid options, the steady release cadence is part of the answer — it’s why Thunderbird stays near the top of our best email clients for Windows and shortlists for developers. And if you’ve been meaning to leave a heavier suite behind, 152’s smoother account setup makes moving to Thunderbird a little less daunting than it used to be.
Alexis Dollé, email expert for 10+ years. Founder of Email Tools. I test every email client and utility myself, then write about them the way I’d explain them to a friend — no marketing fluff, no sponsored rankings, every claim sourced.
LinkedInFrequently asked questions
When was Thunderbird 152 released and is it a security update? — June 16, 2026, and yes
Thunderbird 152.0 was released on June 16, 2026. Yes, it is a security update: Mozilla’s advisory MFSA 2026-60 lists 28 CVEs fixed in this version, 10 of them rated high impact. Because several are memory-safety bugs that Mozilla presumes could be exploited to run arbitrary code, updating is the practical move — Thunderbird auto-updates by default, or you can trigger it from Help, About Thunderbird.
What is one-click Thundermail setup? — automatic config for Mozilla’s hosted email
Thundermail is Mozilla’s own hosted email service, which entered beta in May 2026. Before 152, connecting a Thundermail account meant entering server details by hand. Thunderbird 152 adds one-click account setup for Thundermail, so if you have an account the client configures it automatically — no manual IMAP/SMTP host, port or security settings to type in.
What changed about Gmail sign-in in Thunderbird 152? — it now uses PKCE
Gmail’s OAuth login now uses PKCE (Proof Key for Code Exchange), an OAuth extension that strengthens the authorization flow against code-interception attacks. It’s a behind-the-scenes security hardening — you sign in to Gmail the same way, but the handshake that exchanges your login for an access token is harder to intercept.
Was there a privacy fix for signed emails? — yes, BCC addresses no longer leak
Yes. Thunderbird 152 fixes a bug where BCC recipients were incorrectly included in signed email headers. On previous versions, sending a digitally signed message could expose the addresses of people you had BCC’d — defeating the purpose of blind carbon copy. If you sign your mail with OpenPGP or S/MIME, this fix alone is a reason to update.
Does Thunderbird 152 improve Microsoft Exchange support? — yes, several EWS fixes
It does. The release notes cite several Exchange/EWS fixes: OAuth2 authentication failures corrected, out-of-memory errors when forwarding resolved, a Microsoft 365 deletion limit removed, and EWS message visibility improved. Native Exchange support arrived in late 2025, and 152 continues to stabilize it for the people who rely on it day to day.
Do I need to do anything to get Thunderbird 152? — usually no, it auto-updates
For most people, no. Thunderbird updates itself automatically in the background and prompts you to restart. If you want it now, open Help, then About Thunderbird, and it checks for and downloads the update. Enterprise admins managing deployments also gain SecurityDevices support in policies in this release, for enforcing hardware tokens and smart cards.
Sources
- Thunderbird — “Thunderbird 152.0 Release Notes”, 16 June 2026 (primary: release date; one-click Thundermail account setup; Gmail OAuth PKCE; SecurityDevices in enterprise policies; mail-server hostname verification extended to address books and calendars; “Add” instead of “New” buttons; fixes including BCC recipients no longer in signed email headers, threading beyond 255 levels, Exchange/EWS OAuth2 and out-of-memory forwarding, Microsoft 365 deletion limit removed, IMAP subscription changes without restart, POP3 deadlock)
- Linuxiac — “Mozilla Thunderbird 152 Released with Thundermail Setup and Gmail OAuth Update”, 16 June 2026 (PKCE described as “an OAuth security extension that strengthens authorization flows”; one-click Thundermail setup; SecurityDevices enterprise policy; security fixes referencing MFSA 2026-60; available Windows 10+, macOS 10.15+, Linux)
- Mozilla Security — “Security Vulnerabilities fixed in Thunderbird 152” (MFSA 2026-60), 16 June 2026 (28 CVEs fixed, 10 high impact; CVE-2026-12289 WebRender privilege escalation; CVE-2026-12294 DOM Workers sandbox escape; CVE-2026-12326 memory-safety bugs presumed exploitable to run arbitrary code)
- UpdateStar News — “Thunderbird 152.0 Available With New Features, Fixes, and Thundermail Integration” (Thundermail described as Mozilla’s hosted email service; SecurityDevices for hardware tokens and smart cards; Gmail OAuth PKCE; BCC recipients no longer included in signed email headers; additional Exchange/EWS, spam-filter timing and IMAP fixes)