CVE-2020-6830

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.

• CWE-200

• https://bugzilla.mozilla.org/show_bug.cgi?id=1632387Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-15/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1632387Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-15/Vendor Advisory

Published

May 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6824Initially, a user opens a Private Browsing Window and genera…2.8
• CVE-2020-6825Mozilla developers and community members Tyson Smith and Chr…9.8
• CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Mic…9.8
• CVE-2020-6827When following a link that opened an intent://-schemed URL, …4.7
• CVE-2020-6828A malicious Android application could craft an Intent that w…7.5
• CVE-2020-6829When performing EC scalar point multiplication, the wNAF poi…5.3
• CVE-2020-6831A buffer overflow could occur when parsing and validating SC…9.8
• CVE-2020-6832An issue was discovered in GitLab Enterprise Edition (EE) 8.…5.3
• CVE-2020-6833An issue was discovered in GitLab EE 11.3 and later. A GitLa…7.5
• CVE-2020-6835An issue was discovered in Bftpd before 5.4. There is a heap…9.8
• CVE-2020-6836grammar-parser.jison in the hot-formula-parser package befor…9.8
• CVE-2020-6838In mruby 2.1.0, there is a use-after-free in hash_values_at …9.8