Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Mozilla · Firefox and Thunderbird
A race condition in the handling of ReadableStream objects in Mozilla Firefox and Thunderbird leads to a use-after-free flaw. An attacker with network access can trigger it without authentication or user interaction, though exploitation requires specific conditions that make it harder to reliably achieve.
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 23 days before it was disclosed.
- First seen exploitedVulnCheck KEV evidence23 days before
- Disclosedday 0
- Added to CISA KEVEU database agrees+18 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 3 available links are lower confidence and listed below.
Lower-confidence links (3)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Process InjectionT1055 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Drive-by CompromiseT1189 server-side bug exploitable without user interaction; client-execution technique does not fit
- Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX