Whistleblowers, political activists and others who depend on encrypted email could all be compromised by the bug, the researchers said in a blog post. The vulnerability allows hackers to read an encrypted email by making changes to its HTML, which essentially tricks the affected email applications into decrypting the rest of the message. Mozilla referred questions to the Thunderbird Council, the third-party open-source software group that maintains the Thunderbird email app. Still, some developers of PGP software for email apps aren't taking any chances. The problem, he said, was not with PGP but with the way email clients have implemented it.

Source: Washington Post May 14, 2018 16:36 UTC