CVE-2020-6824

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75.

• CWE-384

• https://bugzilla.mozilla.org/show_bug.cgi?id=1621853Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-12/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1621853Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-12/Vendor Advisory

Published

Apr 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6817bleach.clean behavior parsing style attributes could result …7.5
• CVE-2020-6819Under certain conditions, when running the nsDocShell destru…8.1
• CVE-2020-6820Under certain conditions, when handling a ReadableStream, a …8.1
• CVE-2020-6821When reading from areas partially or fully outside the sourc…7.5
• CVE-2020-6822On 32-bit builds, an out of bounds write could have occurred…8.8
• CVE-2020-6823A malicious extension could have called <code>browser.identi…9.8
• CVE-2020-6825Mozilla developers and community members Tyson Smith and Chr…9.8
• CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Mic…9.8
• CVE-2020-6827When following a link that opened an intent://-schemed URL, …4.7
• CVE-2020-6828A malicious Android application could craft an Intent that w…7.5
• CVE-2020-6829When performing EC scalar point multiplication, the wNAF poi…5.3
• CVE-2020-6830For native-to-JS bridging, the app requires a unique token t…7.5