CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
Affected products
mozilla: firefox; mozilla: thunderbird
References9
- www.mozilla.org/security/advisories/mfsa2020-11/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-14/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-11/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-14/ Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1620818 ExploitIssue Tracking
- bugzilla.mozilla.org/show_bug.cgi?id=1620818 ExploitIssue Tracking
- usn.ubuntu.com/4335-1/ Third Party Advisory
- usn.ubuntu.com/4335-1/ Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
8.1
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 3% percentile: 88 · as of 2 November 2026
- CWE
- CWE-362CWE-416