CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 7.1% chance of exploitation in the next 30 days.

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Affected products

• Mozilla Firefox: before 68.6.1 (fixed in 68.6.1); before 74.0.1 (fixed in 74.0.1)
• Mozilla Thunderbird: before 68.7.0 (fixed in 68.7.0)

Published 2020-04-24. Last modified 2026-06-17.