Vulnerability Intelligence Report
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
CVE-2020-6819
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
8.1
HIGH
Exploitability:2.3
Impact Score:5.9
EPSS Probability:2.98%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗CWE-416 Use After Free
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified < 68.7.0 (affected) |
| Mozilla | Firefox | unspecified < 74.0.1 (affected) |
| Mozilla | Firefox ESR | unspecified < 68.6.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Mozilla Corporation · Vendor · USA |
| Reserved | 2020-01-10T00:00:00 |
| Published | 2020-04-24T15:56:56 |
| Last Updated | 2025-10-21T23:35:45 |
Community Chatter & Buzz