CVE-2020-15663

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

• CWE-427

• https://bugzilla.mozilla.org/show_bug.cgi?id=1643199Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-37/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-38/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-40/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-41/Release Notes, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1643199Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-37/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-38/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-40/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-41/Release Notes, Vendor Advisory

Published

Oct 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15658The code for downloading files did not properly take care of…6.5
• CVE-2020-15659Mozilla developers and community members reported memory saf…8.8
• CVE-2020-1566An elevation of privilege vulnerability exists when the Wind…4.2
• CVE-2020-15660Missing checks on Content-Type headers in geckodriver before…8.8
• CVE-2020-15661A rogue webpage could override the injected WKUserScript use…6.5
• CVE-2020-15662A rogue webpage could override the injected WKUserScript use…6.5
• CVE-2020-15664By holding a reference to the eval() function from an about:…6.5
• CVE-2020-15665Firefox did not reset the address bar after the beforeunload…4.3
• CVE-2020-15666When trying to load a non-video in an audio/video context th…6.5
• CVE-2020-15667When processing a MAR update file, after the signature has b…8.8
• CVE-2020-15668A lock was missing when accessing a data structure and impor…4.3
• CVE-2020-15669When aborting an operation, such as a fetch, an abort signal…8.8