Thunderbird: how to disable javascript?

User Help for Mozilla Thunderbird

Post Posted July 16th, 2008, 12:25 pm

The latest security advisory from Mozilla says that until the next release it is advisable to "Disable JavaScript until a version containing these fixes can be installed."

I can't find this option on my version 2.0..0.1.4

Any suggestions?


User avatar
Posts: 43028
Joined: July 30th, 2003, 5:06 pm

Post Posted July 16th, 2008, 12:46 pm

javascript.allow.mailnews defaults to false in my copy of It controls whether to allow JavaScript in newsgroup messages and e-mails to execute. You can double check that using tools -> options -> advanced -> general -> config editor. At one time there was a checkbox in tools -> options to set that preference but it was removed in later versions, and disabled by default.

I couldn't find the advisory you are talking about. The latest one at states "Security Update (May 1, 2008): A security update has been issued for Thunderbird that fixes moderate security vulnerabilities when JavaScript is enabled in mail. All users should install this security and stability update." (i.e.


Post Posted July 16th, 2008, 8:26 pm

Thanks for the help. I checked mine and it is also at False (default, no doubt).

The Mozilla advisory is at ... 08-33.html

and Secunia's at

Posts: 14412
Joined: May 3rd, 2007, 7:40 am
Location: US

Post Posted July 16th, 2008, 8:30 pm

It's in the MFSA announcement that you are referring to, just underneath the description:
Note: Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail.

Return to Thunderbird Support

Who is online

Users browsing this forum: Google [Bot] and 2 guests