Thunderbird 145 brings native Exchange support

Mozilla has released the mail client Thunderbird in version 145. The new version can natively integrate Exchange accounts using the EWS API. However, the support starts out rudimentarily.

According to the Release Notes for Thunderbird 145, the developers are also addressing the closure of nine vulnerabilities classified as high risk, six as medium risk, and one security-related programming error classified as low threat. According to the overview of closed security vulnerabilities, attackers can likely exploit some of them to execute injected code, and one vulnerability allows breaking out of the sandbox.

New features in the 145 development branch

The new development branch of Thunderbird brings support for DNS over HTTPS. However, the biggest new feature is likely the native support for Exchange accounts. Thunderbird integrates these using the Exchange Web Services API (EWS). To this end, the developers have also added manual configuration for EWS account creation. EWS is an interface for programmers that should be distinguished from Outlook Web Access (OWA), which may seem similar to some—the latter is merely a web GUI for direct use.

The developers describe the current status of Exchange support in a Support article from the Mozilla website. According to this, initial support is limited to email. Calendar and contacts (address book) via the EWS API are to follow at a later date. In the future, support for Exchange access via the Microsoft Graph API will also be provided; the developers ask not to submit bug reports for this.

The support article also describes the setup of Exchange access in Thunderbird, which now relies on the “Account Hub” workflow. In the first dialog, for example, no password needs to be entered yet, as a Microsoft dialog follows that uses the provider's OAuth implementation for this. In the subsequent dialogs, “Exchange Web Services” must then be selected. The support article also lists the limitations that the support currently has. Various functions are not yet supported: address book, calendar, filters, folder size limits, folder subscriptions, message retention policies, message download for offline use, message tagging, NTLM authentication, OAuth authentication with on-premises instances, or shared inboxes. Except for the first two functions, the developers have the remaining points on the roadmap for the first quarter of 2026.

Further changes in Thunderbird include, for example, the removal of Skype from the instant messenger section of the address book, as the service is “retired.” The term “Junk” has been replaced by the more common “Spam” in various language versions. The Thunderbird project no longer creates 32-bit binaries for x86-Linux. The release notes list a number of minor bug fixes that should make the new version an interesting update for many users.

About a month ago, the Mozilla developers released Thunderbird versions ESR 140.4 and 144. They primarily patched security vulnerabilities.

(dmk)