CVE-2020-12388
10.0
CRITICAL · CVSS 3.1 · EPSS 3.4% (pctl 89)
In your normal cycle
Critical by CVSS (10), but no sign of active exploitation.
Description
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 3.44% — more likely to be exploited than 89% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-05-26 |
| Last modified | 2026-06-17 |
Affected (3)
| Vendor | Product |
|---|---|
| microsoft | windows |
| mozilla | firefox |
| mozilla | firefox esr |
References
- http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1618911
- https://www.mozilla.org/security/advisories/mfsa2020-16/
- https://www.mozilla.org/security/advisories/mfsa2020-17/
- http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1618911
- https://www.mozilla.org/security/advisories/mfsa2020-16/
- https://www.mozilla.org/security/advisories/mfsa2020-17/
→ the Explorer · watch your stack · NVD