Use‑After‑Free Vulnerability (CVE‑2020‑6820) in Mozilla Firefox and Thunderbird
What It Is — Mozilla disclosed a race‑condition use‑after‑free bug in Firefox and Thunderbird when handling a ReadableStream. The flaw can be leveraged to execute arbitrary code on the victim’s machine.
Exploitability — Public proof‑of‑concept exists; CVSS v3.1 base score 7.5 (High).
Affected Products — Mozilla Firefox (all supported desktop releases prior to the security update) and Mozilla Thunderbird (all supported releases prior to the security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the criticality of a vulnerability‑management control that mandates continuous scanning of client‑side software and rapid remediation.
- Provides concrete audit evidence that an organization is actively monitoring and patching high‑severity flaws—a control mapped to many frameworks (e.g., NIST CSF Identify ID‑RA‑1, ISO 27001 A.12.6).
- Shows that continuous control monitoring can surface supply‑chain‑relevant risks before they propagate to downstream services.
Recommended Actions
- Inventory all endpoints running Firefox or Thunderbird.
- Verify that each instance is updated to the patched versions (Firefox 84 or later; Thunderbird 78.10 or later).
- Deploy the updates through centralized patch‑management tools.
- Record remediation status in your vulnerability‑management system to create defensible audit evidence.
Source: CISA KEV – CVE‑2020‑6820