CVE-2020-12388

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-26 · updated 2026-06-17
Weakness: CWE-20

Description

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Affected products

Mozilla Firefox: before 76.0 — fixed in 76.0
Mozilla Firefox ESR: before 68.8.0 — fixed in 68.8.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 76.0; Mozilla Firefox ESR 68.8.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1618911
https://www.mozilla.org/security/advisories/mfsa2020-16/
https://www.mozilla.org/security/advisories/mfsa2020-17/
http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1618911
https://www.mozilla.org/security/advisories/mfsa2020-16/
https://www.mozilla.org/security/advisories/mfsa2020-17/

Get alerted when CVE-2020-12388 or the next vulnerability affects your stack