CVE-2020-6812

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-68135.3When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker CVE-2020-68149.8Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corrupt CVE-2020-68159.8Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corrupt CVE-2020-68166.1In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argume CVE-2020-68177.5bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an CVE-2020-68198.1Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted atta CVE-2020-68208.1Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in t CVE-2020-68217.5When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification r CVE-2020-68228.8On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is CVE-2020-68239.8A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promi CVE-2020-68242.8Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Fi CVE-2020-68259.8Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR