Mozilla Firefox 74.0.0/ESR 68.6.0 nsDocShell Destructor use after free

Summaryinfo

A vulnerability identified as critical has been detected in Mozilla Firefox 74.0.0/ESR 68.6.0. The impacted element is an unknown function of the component nsDocShell Destructor. The manipulation leads to use after free. This vulnerability is traded as CVE-2020-6819. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox 74.0.0/ESR 68.6.0 (Web Browser). It has been rated as critical. This issue affects some unknown functionality of the component nsDocShell Destructor. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

The weakness was shared 04/03/2020 by Francisco Alonso and Javier Marcos as MFSA 2020-11 as confirmed security advisory (Website). It is possible to read the advisory at mozilla.org. The identification of this vulnerability is CVE-2020-6819. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a private exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2025).

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 208627 (CentOS 7 : firefox (RHSA-2020:1338)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/03/2021 with a due date of 05/03/2022:

Apply updates per vendor instructions.

Upgrading to version 74.0.1 or ESR 68.6.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (568), Tenable (208627) and EUVD (EUVD-2020-27963). The entry VDB-152820 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 74.0.0
• ESR 68.6.0

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion