CVE-2020-26950Firefox Use-After-Free
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.
Published Dec 9, 2020 · Updated Aug 5, 2026 · Also known as DEBIAN-CVE-2020-26950, DLA-2448-1, DLA-2449-1, DSA-4788-1, DSA-4790-1, MFSA 2020-49, SUSE-SU-2020:14542-1, SUSE-SU-2020:3311-1, SUSE-SU-2020:3312-1, SUSE-SU-2020:3331-1, SUSE-SU-2020:3418-1, UBUNTU-CVE-2020-26950, USN-4625-1
Key Facts
Patch immediately- CVE-2020-26950 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Firefox (Mozilla), Firefox ESR (Mozilla), Thunderbird (Mozilla) and 20 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 42% probability of exploitation in the next 30 days.
- Fixed versions are available, including Firefox 0:78.4.1-1.el6_10, Firefox 0:78.4.1-1.el7_9, Firefox 0:78.4.1-1.el8_0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
42%
Higher than 98.6% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
61/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2020-26950
- advisoryhttps://ubuntu.com/security/CVE-2020-26950
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2020-26950
- advisoryhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-26950
- advisoryRHSA-2020:5099
- advisoryRHSA-2020:5100
Description
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.
Affected Products
218 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | >= < 82.0.3 | 82.0.3 |
| Firefox ESRMozilla | >= < 78.4.1 | 78.4.1 |
| ThunderbirdMozilla | >= < 78.4.2 | 78.4.2 |
| librewolfalpine | See advisory | 82.0.3-r0 |
| mozjs78alpine | See advisory | 78.4.1-r0 |
Patched Releases
Firefox
0:78.4.1-1.el6_10, 0:78.4.1-1.el7_9, 0:78.4.1-1.el8_0, 78.4.1-1.0.1.el6_10, 78.4.1-1.0.1.el7_9, 78.4.1-1.0.1.el8_3, 82.0.3-1, 82.0.3-r0, 82.0.3+build1-0ubuntu0.16.04.1, 82.0.3+build1-0ubuntu0.18.04.1, 82.0.3+build1-0ubuntu0.20.04.1, 82.0.3
Firefox ESR
128.5.1-1.1, 78.4.1esr-1, 78.4.1esr-1~deb10u1, 78.4.1esr-1~deb9u1, 78.5.0-r0, 78.4.1
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
librewolf
82.0.3-r0
Thunderbird
78.4.2, 0:78.4.3-1.el6_10, 0:78.4.3-1.el7_9, 0:78.4.3-1.el8_1, 1:78.4.2-1, 1:78.4.2-1~deb10u1, 1:78.4.2-1~deb9u1, 1:78.7.1+build1-0ubuntu0.20.04.1, 1:78.8.1+build1-0ubuntu0.18.04.1, 78.4.3-1.0.1.el6_10, 78.4.3-1.0.1.el7_9, 78.4.3-1.0.1.el8_3, 78.4.3-1.amzn2.0.1, 78.5.1-r0
MozillaFirefox
78.4.1-112.32.1, 78.4.1-3.116.1, 78.4.1-78.102.1, 78.4.1-8.14.1, 78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1, 92.0-1.2
MozillaFirefox-branding-upstream
78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1, 92.0-1.2
MozillaFirefox-buildsymbols
78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1
MozillaFirefox-devel
78.4.1-112.32.1, 78.4.1-3.116.1, 78.4.1-8.14.1, 78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1, 92.0-1.2
MozillaFirefox-translations-common
78.4.1-112.32.1, 78.4.1-3.116.1, 78.4.1-78.102.1, 78.4.1-8.14.1, 78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1, 92.0-1.2
MozillaFirefox-translations-other
78.4.1-3.116.1, 78.4.1-78.102.1, 78.4.1-8.14.1, 78.4.1-lp151.2.76.1, 78.4.1-lp152.2.27.1, 92.0-1.2
MozillaThunderbird
78.4.2-3.103.2, 78.4.2-lp151.2.56.1, 78.4.2-lp152.2.16.1, 91.1.1-1.1
MozillaThunderbird-translations-common
78.4.2-3.103.2, 78.4.2-lp151.2.56.1, 78.4.2-lp152.2.16.1, 91.1.1-1.1
MozillaThunderbird-translations-other
78.4.2-3.103.2, 78.4.2-lp151.2.56.1, 78.4.2-lp152.2.16.1, 91.1.1-1.1
mozjs
NA
mozjs-devel
NA
mozjs60
NA
mozjs78
78.4.1-r0
Timeline
Publicly disclosed
Dec 9, 2020
Last updated
Aug 5, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisorysecurity-tracker.debian.org · CVE-2020-26950
- advisoryubuntu.com · CVE-2020-26950
- advisorycve.org · CVERecord
- advisorymozilla.org · mfsa2020-49
- advisoryRHSA-2020:5099
FAQ
Common Questions.
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.
Affected: Firefox (Mozilla) versions >= < 82.0.3; Firefox ESR (Mozilla) versions >= < 78.4.1; Thunderbird (Mozilla) versions >= < 78.4.2, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Firefox 0:78.4.1-1.el6_10, Firefox 0:78.4.1-1.el7_9, Firefox 0:78.4.1-1.el8_0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2020-26950 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo