CVE-2020-12388 Security feature bypass in Firefox
Insufficient access control in Firefox content processes allows sandbox escape on Windows, enabling privilege escalation and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12388?
CVE-2020-12388 is a critical vulnerability in Mozilla Firefox, published on 26 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Weakness: CWE-20
Which versions are affected by CVE-2020-12388?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Firefox Esr.
How do I fix CVE-2020-12388?
Upgrade to a fixed version.
Is CVE-2020-12388 being exploited?
There is no known exploitation of CVE-2020-12388 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-fx7p-g7cp-xx65, UBUNTU-CVE-2020-12388.