CVE-2020-6815

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 74.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-68166.1In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argume CVE-2020-68177.5bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an CVE-2020-68198.1Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted atta CVE-2020-68208.1Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in t CVE-2020-68217.5When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification r CVE-2020-68228.8On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is CVE-2020-68239.8A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promi CVE-2020-68242.8Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Fi CVE-2020-68259.8Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR CVE-2020-68269.8Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed CVE-2020-68274.7When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into dis CVE-2020-68287.5A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file