CVE-2020-6819

What is nsDocShell?

nsDocShell is a core Firefox/Gecko engine component that manages document loading and navigation within a browser tab — the internal machinery behind every page load, back/forward navigation, and frame transition.

Overview

CVE-2020-6819 is a use-after-free vulnerability (CWE-362, race condition leading to concurrent execution using shared resource) triggered by a race condition in the nsDocShell destructor under certain conditions. Mozilla shipped Firefox 74.0.1 and Thunderbird 68.6.1 as an emergency out-of-band release in April 2020, explicitly citing reports that this and the closely related CVE-2020-6820 (also enriched on this site) were being exploited in targeted attacks in the wild (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High).

Technical Details

A race condition in nsDocShell's destructor logic means that, under specific timing conditions, the object can be freed while another part of the browser still holds and later uses a reference to it — the classic use-after-free pattern. Because triggering the race reliably requires precise timing (reflected in the "High" attack complexity rating), successful exploitation is harder to achieve consistently than a straightforward memory-safety bug, but was nonetheless confirmed in real-world attacks.

Discovery

Mozilla credited an anonymous researcher with reporting that the vulnerability was being exploited in the wild, prompting the emergency out-of-band release rather than waiting for the next scheduled Firefox update cycle.

Exploitation Context

Mozilla's advisory explicitly stated awareness of "targeted attacks in the wild" exploiting this vulnerability — one of the more direct vendor acknowledgments of active exploitation from this era. Emergency, unscheduled security releases like Firefox 74.0.1 are relatively rare and signal that Mozilla considered the confirmed in-the-wild exploitation serious enough to bypass its normal release cadence.

Remediation

1. Update Firefox and Thunderbird to a version including this fix (74.0.1/68.6.1 or later) — this should occur automatically for most users via built-in auto-update, but verify on any system where updates might be restricted or delayed.
2. Patch alongside CVE-2020-6820, which was fixed in the same emergency release and exploited in the same wave of targeted attacks.
3. Enable and don't disable Firefox/Thunderbird's automatic update mechanism in managed environments, given how quickly Mozilla needed to respond to confirmed active exploitation.
4. Treat any system that remained on Firefox 74.0/Thunderbird 68.6.0 or earlier past early April 2020 as a candidate for compromise assessment, given Mozilla's direct acknowledgment of targeted in-the-wild attacks.