CVE-2020-6819: Mozilla Firefox and Thunderbird use-after-free via nsDocShell race condition

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild targeted exploitation and KEV listing, but exploitation requires winning a race condition and the record gives no further exploit detail.

What it is

A race condition in the nsDocShell destructor can free memory that is still referenced, producing a use-after-free in Firefox and Thunderbird. Mozilla states it is aware of targeted attacks in the wild abusing this flaw, so it is not a theoretical bug.

Impact

An attacker can corrupt memory and potentially execute code in the context of the browser or mail client, or crash it. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is network-reachable with no privileges and no user interaction required (AV:N/AC:H/PR:N/UI:N), so it is reached by delivering crafted web or mail content to the vulnerable application. Exploitation depends on winning the race condition, which the high attack complexity reflects.

Exploitation

Listed in CISA KEV since 2021-11-03 with a 2022-05-03 remediation due date, and Mozilla's advisory states targeted attacks in the wild; EPSS 30-day probability is about 3.0 percent (86.8th percentile). A Mozilla Bugzilla reference is tagged Exploit.

What to do

• Update Firefox to 74.0.1 or later, Firefox ESR to 68.6.1 or later, and Thunderbird to 68.7.0 or later, per Mozilla advisories mfsa2020-11 and mfsa2020-14.
• Apply the Ubuntu security update referenced in USN-4335-1 for packaged builds.
• Track KEV remediation due dates and confirm all endpoints and mail clients meet the fixed versions.
• Where immediate patching is not possible, reduce exposure by restricting untrusted web and mail content and limiting use of the affected clients.

Detection

• Inventory Firefox, Firefox ESR and Thunderbird versions across endpoints and flag anything below the fixed releases.
• Hunt for crashes or abnormal process terminations in firefox, firefox-esr or thunderbird binaries that could indicate memory corruption attempts.
• Monitor for exploit-related activity against browser or mail client processes using endpoint detection telemetry and correlate with known exploitation indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.