Vulnerability record · CVE-2020-6820 · published 24 April 2020
CVE-2020-6820: Mozilla Firefox and Thunderbird ReadableStream race condition use-after-free
Mozilla · Firefox
A race condition in ReadableStream handling causes a use-after-free in Firefox and Thunderbird. Mozilla states it is aware of targeted attacks in the wild abusing this flaw, so it is a real, exploited memory-corruption bug rather than a theoretical one.
Description
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityConfirmed in-the-wild exploitation and KEV listing, but the high attack complexity and the availability of patches since 2020 lower the urgency for fully updated environments.
What it is
A race condition in ReadableStream handling causes a use-after-free in Firefox and Thunderbird. Mozilla states it is aware of targeted attacks in the wild abusing this flaw, so it is a real, exploited memory-corruption bug rather than a theoretical one.
Impact
An attacker can corrupt freed memory, which in a browser or mail client typically leads to code execution in the context of the affected process or at minimum a crash. The CVSS vector rates confidentiality, integrity and availability all as high.
Attack surface
Reached over the network (AV:N) with no privileges and no user interaction required per the vector, meaning a crafted page or message can trigger it. The description does not specify the exact delivery path beyond ReadableStream handling.
Exploitation
Listed in CISA KEV since 2021-11-03, and Mozilla states targeted attacks in the wild were abusing it. EPSS 30-day probability is about 7 percent (93rd percentile), so exploitation is confirmed but not mass-scale.
What to do
- Upgrade Firefox to 74.0.1 or later, Firefox ESR to 68.6.1 or later, and Thunderbird to 68.7.0 or later.
- Apply the vendor and distribution updates referenced in the Mozilla advisories and Ubuntu USN-4335-1.
- Track KEV remediation deadlines for any remaining unpatched endpoints.
- Where immediate patching is not possible, restrict untrusted web and mail content and reduce exposure of affected clients.
Detection
- Inventory Firefox and Thunderbird versions across endpoints and flag anything below the fixed releases.
- Hunt for crash reports or process terminations in firefox, thunderbird or plugin-container that cluster around browsing or mail activity.
- Monitor for unexpected child processes or network connections spawned from browser or mail client processes.
- Review proxy and DNS logs for known exploit-hosting or watering-hole domains tied to this campaign.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-6820 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Mozilla Firefox And Thunderbird Use-After-Free Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 | Issue TrackingPermissions Required |
| https://usn.ubuntu.com/4335-1/ | Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2020-11/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2020-14/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 | Issue TrackingPermissions Required |
| https://usn.ubuntu.com/4335-1/ | Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2020-11/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2020-14/ | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6820 | US Government Resource |
Track CVE-2020-6820 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-6820), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
