CVE-2020-6819 Mozilla Firefox And Thunderbird Use-After-Free

Q: Is CVE-2020-6819 being exploited?

Yes. Attackers have exploited CVE-2020-6819 in the wild since at least 3 Nov 2021.

Q: How do I fix CVE-2020-6819?

Upgrade to a fixed version. US federal agencies must fix it by 3 May 2022.

Exploited in the wild High 8.1 Published 24 Apr 2020 Updated 21 Oct 2025

A race condition in the nsDocShell destructor leads to a use-after-free, allowing attackers to execute arbitrary code via targeted attacks.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-6819?

CVE-2020-6819 is a high-severity use after free vulnerability in Mozilla Firefox, published on 24 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Weakness: CWE-362, CWE-416

Which versions are affected by CVE-2020-6819?

It affects 2 products.

Products include Mozilla Firefox, Mozilla Thunderbird.

How do I fix CVE-2020-6819?

Upgrade to a fixed version. US federal agencies must fix it by 3 May 2022.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2020-6819 being exploited?

Yes. Attackers have exploited CVE-2020-6819 in the wild since at least 3 Nov 2021.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-6819, GHSA-cv8q-mpvf-42h2, UBUNTU-CVE-2020-6819.