CVE-2020-6819

What it actually does

Race condition during nsDocShell destructor execution leads to use-after-free, enabling memory corruption and potential arbitrary code execution.

Why it matters to the business

Targeted attackers can gain full control of user systems running vulnerable browsers or email clients, resulting in data theft, credential compromise, or further network intrusion; high urgency due to confirmed in-the-wild exploitation and past CISA remediation deadline.

How an attack unfolds

Attacker delivers malicious web content or email to a victim running an affected Mozilla product; the crafted input triggers a timing-dependent race in the nsDocShell destructor, causing a use-after-free that is leveraged for code execution, consistent with observed targeted attacks.

How to fix it

Upgrade Firefox to 74.0.1 or later, Firefox ESR to 68.6.1 or later, and Thunderbird to 68.7.0 or later; remove or isolate any remaining unpatched instances.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases listed in the advisory; re-scan systems after patching to confirm absence of vulnerable binaries.

Typical attack path

1. Send malicious webpage or email attachment to target
2. Victim opens content in vulnerable Firefox, ESR, or Thunderbird
3. Race condition triggers use-after-free in nsDocShell
4. Attacker achieves memory corruption and executes arbitrary code

How to detect it

Examine browser and email client crash logs, process creation events, and memory dumps for signs of use-after-free exploitation or unexpected code execution around the nsDocShell component.

What your security team should do

• Prioritize immediate patching of all Mozilla Firefox, ESR, and Thunderbird instances given KEV status and known exploitation
• Block or filter untrusted web and email content until updates are applied
• Review endpoint logs for post-exploitation artifacts from historical targeted attacks