Known exploited vulnerability

CVE-2020-6820

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Past due Added Federal deadline

What is affected

Vendor Mozilla
Product Firefox and Thunderbird
Weakness CWE-362

The vulnerability

Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

Required action

Apply updates per vendor instructions.

US federal civilian agencies were required to act by 3 May 2022 under BOD 22-01. The deadline is a compliance date, not a measure of severity — it says nothing about how dangerous the flaw is to anyone else.

Where this comes from

Every field on this page is taken from the CISA Known Exploited Vulnerabilities catalog, last synced 11 Nov 2026, 21:30. Nothing here is our own assessment. For the technical scoring, see the NVD record below.

NVD record ↗ CVE.org record ↗

More from Mozilla

CVE-2010-3765

Mozilla Multiple Products

Mozilla Multiple Products Remote Code Execution Vulnerability

Past due · 6 Oct 2025 CVE-2024-9680

Mozilla Firefox

Mozilla Firefox Use-After-Free Vulnerability

Ransomware · 15 Oct 2024 CVE-2016-9079

Mozilla Firefox, Firefox ESR, and Thunderbird

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

Past due · 22 Jun 2023 CVE-2015-4495

Mozilla Firefox

Mozilla Firefox Security Feature Bypass Vulnerability

Past due · 25 May 2022