Sender spoofing via invisible Braille spaces

Sender spoofing in Mozilla Thunderbird before 91.10 allows remote attackers to display a false sender address in a signed email. The message header renderer displays repeated Braille Pattern Blank characters in the sender name, pushing the attacker's actual address out of view while signature validation compares that hidden address. Exploitation requires a recipient to view the crafted message and Thunderbird to accept the attacker's signing key or certificate; the displayed signature then falsely authenticates an arbitrary visible sender address.