Every CVE Search/ Get API key

CVE-2020-12388

The Firefox content processes did not sufficiently lockdown access control which could result in...

10.0 CriticalFix available

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.52%Down 7.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 10.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
CVE-2020-12388
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
CVE-2020-12388
Updated
2026-11-02
EUVDEUVD-2020-4700 No score

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
EUVD-2020-4700
Updated
2026-11-03
GitHub AdvisoriesGHSA-fx7p-g7cp-xx65 10.0

The Firefox content processes did not sufficiently lockdown access control which could result in...

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
GHSA-fx7p-g7cp-xx65
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2020-12388 10.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
ALPINE-CVE-2020-12388
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2020-12388 10.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Record
UBUNTU-CVE-2020-12388
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2020:0621-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Update to version 68.8.0 ESR (bsc#1171186):

  • CVE-2020-12387: Use-after-free during worker shutdown
  • CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
  • CVE-2020-12389: Sandbox escape with improperly separated process types
  • CVE-2020-6831: Buffer overflow in SCTP chunk input validation
  • CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'
  • CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
  • CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0621-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2020:1209-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Update to version 68.8.0 ESR (bsc#1171186):

  • CVE-2020-12387: Use-after-free during worker shutdown
  • CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
  • CVE-2020-12389: Sandbox escape with improperly separated process types
  • CVE-2020-6831: Buffer overflow in SCTP chunk input validation
  • CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'
  • CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
  • CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8
Record
SUSE-SU-2020:1209-1
Updated
2026-11-02
OSVSUSE-SU-2020:1218-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Update to version 68.8.0 ESR (bsc#1171186):

  • CVE-2020-12387: Use-after-free during worker shutdown
  • CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
  • CVE-2020-12389: Sandbox escape with improperly separated process types
  • CVE-2020-6831: Buffer overflow in SCTP chunk input validation
  • CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'
  • CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
  • CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8
Record
SUSE-SU-2020:1218-1
Updated
2026-11-02
OSVSUSE-SU-2020:14359-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 68.8.0 ESR MFSA 2020-17 (bsc#1171186)

    • CVE-2020-12387 (bmo#1545345) Use-after-free during worker shutdown
    • CVE-2020-12388 (bmo#1618911) Sandbox escape with improperly guarded Access Tokens
    • CVE-2020-12389 (bmo#1554110) Sandbox escape with improperly separated process types
    • CVE-2020-6831 (bmo#1632241) Buffer overflow in SCTP chunk input validation
    • CVE-2020-12392 (bmo#1614468) Arbitrary local file access with 'Copy as cURL'
    • CVE-2020-12393 (bmo#1615471) Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
    • CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704, bmo#1624098, bmo#1625749, bmo#1626382, bmo#1628076, bmo#1631508) Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

  • Since firefox-gcc8 now has disabled autoreqprov for firefox-libstdc++6 and firefox-libgcc_s1, those packages don't provide some capabilities, we have to disable AutoReqProv in MozillaFirefox too so they're not added as automatic requirements. (bsc#1162828)

Record
SUSE-SU-2020:14359-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.13
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.14
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.15
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.16
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.17
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.18
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.19
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.20
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.21
 before 76.0-r0
76.0-r0
Show 48 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 before 76.0-r0
76.0-r0
firefox
Alpine:v3.23
 before 76.0-r0
76.0-r0
firefox-esr
Alpine:v3.11
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.12
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.13
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.14
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.15
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.16
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.17
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.18
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.19
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.20
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.21
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.22
 before 68.8.0-r0
68.8.0-r0
firefox-esr
Alpine:v3.23
 before 68.8.0-r0
68.8.0-r0
librewolf
Alpine:v3.21
 before 76.0-r0
76.0-r0
librewolf
Alpine:v3.22
 before 76.0-r0
76.0-r0
librewolf
Alpine:v3.23
 before 76.0-r0
76.0-r0
librewolf
Alpine:v3.24
 before 76.0-r0
76.0-r0
mozjs68
Alpine:v3.12
 before 68.8.0-r0
68.8.0-r0
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 68.8.0-3.87.1
68.8.0-3.87.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:OpenStack Cloud 7
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:OpenStack Cloud 8
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Enterprise Storage 5
 before 68.8.0-109.119.1
68.8.0-109.119.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 68.8.0-78.73.1
68.8.0-78.73.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
MozillaFirefox
openSUSE:Leap 15.1
 before 68.8.0-lp151.2.45.1
68.8.0-lp151.2.45.1
MozillaFirefox
openSUSE:Tumbleweed
 before 92.0-1.2
92.0-1.2
firefox-esr
openSUSE:Tumbleweed
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12388 is a critical vulnerability (CVSS 10.0) in Mozilla Firefox, published May 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.52%, the 89th percentile. Fixed in firefox 76.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,678 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open