CVE-2020-12387

HIGH

8.1

CVSS Score

Published: May 26, 2020 at 05:04 PM UTC

Updated: June 17, 2026 at 02:51 AM UTC

3 products affected across 1 vendorFirefoxThunderbirdFirefox ESR

Using Firefox ESR by Mozilla?

Get instant alerts when new vulnerabilities affect Firefox ESR - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 1%

Description

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Firefox · Mozilla

95%

v < 76

Affected range stops below 76, so it looks safe — our inference, not a vendor statement

Affected range stops below 76.0, so it looks safe — our inference, not a vendor statement

Firefox ESR · Mozilla

95%

v < 68.8

Affected range stops below 68.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 68.8.0, so it looks safe — our inference, not a vendor statement

Thunderbird · Mozilla

95%

v < 68.8.0

Affected range stops below 68.8.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://usn.ubuntu.com/4373-1/