CVE-2020-6820

ENISA EUVD: EUVD-2020-27964 ↗
Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 2 articles
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
3.13%
probability
This CVE has a 3.13% probability of being exploited in the next 30 days.
0% Top 87.0th percentile of all CVEs 100%

CVSS v3.1

Source: NVD
8.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Project Zero
Use-after-free when handling a ReadableStream

Affected Products

Attack Intelligence

Google Project Zero

Discovered
April 1, 2020
Patched
April 3, 2020
Reported by
Francisco Alonso @revskills working with Javier Marcos of @JMPSec
Root Cause Analysis
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-6820.html

Signal Intelligence

Confidenceⓘ
92%
EPSS 3.13%
CVSS v3.1 8.1
Mentions 2
Last Seen Apr 06, 2020

CNA Information

Analyst Note

CVE-2020-6820 is confirmed as a high-severity use-after-free vulnerability in Mozilla products with active exploitation documented in the wild. The presence of Project Zero disclosure, CERT-EU advisory coverage, and official vendor patches for Firefox 74.0.1, Firefox ESR 68.6.1, and Thunderbird 68.7.0 provide strong corroboration of the vulnerability's authenticity and impact.

Triage Info

Decided atMar 03, 2026