Thunderbird 149.0 Arrives with New Address Book Tools and EWS Improvements
Thunderbird 149.0 Arrives with New Address Book Tools and EWS Improvements
- 60% of MD5 Password Hashes Can Be Cracked in Under an Hour with a Single GPU
- Dirty Frag: Root Access on Every Major Linux Distribution — No Patch, No Warning
- Ubuntu 26.04 LTS (Resolute Raccoon): The Most Ambitious Ubuntu LTS in a Decade
- Proton Mail: Data Transferred to FBI Again!
- How Close Are Quantum Computers to Breaking RSA-2048?
- How to Prevent Ransomware Infection Risks?
- What is the best alternative to Microsoft Office?
Thunderbird 149.0 Arrives with New Address Book Tools and EWS Improvements
Mozilla’s open-source email client ships a focused update: CSV export for contacts, persistent starred messages in Exchange Web Services, and account hub creation for address books — alongside the usual wave of bug fixes and security patches.
The Thunderbird project released version 149.0 of its desktop email client on March 24, 2026, delivering a small but meaningful set of new capabilities alongside an extensive list of bug fixes. The release is available now as a free download from thunderbird.net, the project’s official home, for all three supported platforms.
Thunderbird remains fully free to use, with the project sustained by voluntary donations from its community. It is open-source software developed under the umbrella of MZLA Technologies Corporation, a wholly owned subsidiary of the Mozilla Foundation.
What’s New
Three headline additions define this release, each addressing long-standing workflow gaps for Thunderbird’s power users.
Bug Fixes: A Lengthy List
Version 149.0 is notable for the breadth of its fixes. Among the resolved issues: Shift-clicking the Edit button in drafts view now works as expected; “Replace All” in the composer correctly updates plain-text content in real time; and “Repair text encoding” no longer duplicates recipients or attachments — a disruptive bug that caught users off guard.
Readability in dark themes also sees improvement, with link colors now offering sufficient contrast. Several folder-tree issues have been resolved, including a bug where new-message stars stopped displaying and another where renaming a unified folder inadvertently created a duplicate entry.
On the security and cryptography front, the reason for a revoked certificate is now properly surfaced to users. Fixes also address failures opening OpenPGP signed messages in certain header configurations, and a long-standing issue preventing S/MIME CSR file generation.
Calendar users receive attention as well: a broken “Publish Calendar” dialog that showed only an empty OK/Cancel popup has been repaired, dismissed Gmail calendar reminders now behave correctly, and local calendar HTML export is restored.
Security Fixes
Thunderbird 149.0 includes a security update, listed in the release notes under Mozilla’s standard security advisory process. The full details of severity ratings and individual CVEs will be published separately by Mozilla at their security advisories page once the advisory is released. As of this article’s publication, the advisory for Thunderbird 149 has not yet been posted.
It is worth noting that Thunderbird’s security exposure differs from Firefox in one important respect: JavaScript execution is disabled by default in email messages, which significantly reduces the attack surface compared to a full web browser. Nevertheless, security patches in any new version should be taken seriously, and users are encouraged to update.
System Requirements
| Platform | Minimum Requirement |
|---|---|
| Windows | Windows 10 or later |
| macOS | macOS 10.15 (Catalina) or later |
| Linux | GTK+ 3.14 or higher |
How to Update
Existing Thunderbird installations can update via Help → About Thunderbird, which will trigger an automatic check and download. Fresh installations are available at thunderbird.net/en-US/thunderbird/all/, where builds for all supported languages and platforms are listed.
This article is based on the official Thunderbird 149.0 release notes published at thunderbird.net and Mozilla’s security advisory index. Information about the security advisory will be updated when Mozilla publishes it.
