CVE-2020-6812

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

• CWE-200

• https://bugzilla.mozilla.org/show_bug.cgi?id=1616661Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/4328-1/Third Party Advisory
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-08/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-09/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-10/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1616661Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/4328-1/Third Party Advisory
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-08/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-09/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-10/Vendor Advisory

Published

Mar 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6806By carefully crafting promise resolutions, it was possible t…8.8
• CVE-2020-6807When a device was changed while a stream was about to be des…8.8
• CVE-2020-6808When a JavaScript URL (javascript:) is evaluated and the res…6.5
• CVE-2020-6809When a Web Extension had the all-urls permission and made a …7.5
• CVE-2020-6810After a website had entered fullscreen mode, it could have u…4.3
• CVE-2020-6811The 'Copy as cURL' feature of Devtools' network tab did not …8.8
• CVE-2020-6813When protecting CSS blocks with the nonce feature of Content…5.3
• CVE-2020-6814Mozilla developers reported memory safety bugs present in Fi…9.8
• CVE-2020-6815Mozilla developers reported memory safety and script safety …9.8
• CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clea…6.1
• CVE-2020-6817bleach.clean behavior parsing style attributes could result …7.5
• CVE-2020-6819Under certain conditions, when running the nsDocShell destru…8.1