CVE-2020-6820

Timeline

Detection, updates, and resolution for this record.

1. Apr 24, 2020 · Catalog

   Detected

   Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Affected

• cpe mozilla/firefoxversion unspecified
• cpe mozilla/thunderbirdversion unspecified
• vendor Mozilla Firefox and Thunderbirdversion unspecified

Sources

• CISA KEVCVE-2020-6820

  Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

  cisa.gov
• CVE.orgCVE-2020-6820

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2020-6820

  30-day exploitation probability 7.1%

  first.org
• NIST NVDCVE-2020-6820

  Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

  nvd.nist.gov

References

• Issue Tracking · bugzilla.mozilla.org
• CISA note · nvd.nist.gov
• Third Party Advisory · usn.ubuntu.com
• Vendor Advisory · mozilla.org
• Vendor Advisory · mozilla.org