CVE-2020-6821: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

Affected products

• Mozilla Firefox: before 75.0 (fixed in 75.0)
• Mozilla Firefox ESR: before 68.7.0 (fixed in 68.7.0)
• Mozilla Thunderbird: before 68.7.0 (fixed in 68.7.0)

Published 2020-04-24. Last modified 2026-06-17.