CVE-2020-6820

What is a ReadableStream?

ReadableStream is a web API used by JavaScript to read streaming data — for example, incrementally processing a large fetch response or file — without needing to hold the entire content in memory at once. Like nsDocShell (see the companion CVE-2020-6819, also enriched on this site), it's core browser engine plumbing rather than an obscure edge feature.

Overview

CVE-2020-6820 is a use-after-free vulnerability (CWE-362) triggered by a race condition when handling a ReadableStream under certain conditions. Mozilla fixed it in the same emergency Firefox 74.0.1 / Thunderbird 68.6.1 release as CVE-2020-6819, both cited in the same advisory as being exploited in targeted attacks in the wild (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High).

Technical Details

The race condition occurs during ReadableStream handling, where under specific timing conditions an object can be freed while still referenced elsewhere in the browser engine, leading to a use-after-free that an attacker can exploit for further memory corruption. As with its companion CVE, the "High" attack complexity reflects the precision timing required to reliably trigger the race condition.

Discovery

Reported to Mozilla by an anonymous researcher alongside CVE-2020-6819, with both vulnerabilities cited as being actively exploited in targeted attacks at the time of Mozilla's emergency April 2020 release.

Exploitation Context

This CVE and CVE-2020-6819 represent a documented pair of actively-exploited Firefox/Thunderbird 0-days fixed together in an unscheduled emergency release — a strong signal of confirmed real-world targeted exploitation rather than proactive hardening.

Remediation

1. Update Firefox and Thunderbird to a version including this fix (74.0.1/68.6.1 or later).
2. Patch alongside CVE-2020-6819, fixed in the same emergency release and exploited in the same attack wave.
3. Enable automatic updates for Firefox and Thunderbird in managed environments to minimize exposure windows for emergency fixes of this kind.
4. Treat any system on Firefox 74.0/Thunderbird 68.6.0 or earlier past early April 2020 as a candidate for compromise assessment given Mozilla's direct acknowledgment of targeted attacks.