CVE-2020-15670

HighCVSS 8.8/10Last modified Aug 19, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416CWE-617

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2020
Last modified
Aug 19, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-156713.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the inputCVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corrCVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presumeCVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. ThiCVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed aCVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN userCVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could coCVE-2020-156805.3If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken imCVE-2020-156817.5When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anothCVE-2020-156826.5When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An a
CVE-2020-15670: High severity, CVSS 8.8 | Vulnix