CVE-2020-12407

high

Published — · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

8.0

Description

Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. This vulnerability affects Firefox < 77.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2020-12407

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2020-12407.html

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-202006-1

OS impact

OS	Version	Status	Fixed in
arch		fixed	`77.0-1`
sles		affected
debian	sid	fixed	`77.0-1`

References

https://security.archlinux.org/ASA-202006-1
https://www.suse.com/security/cve/CVE-2020-12407.html
https://security-tracker.debian.org/tracker/CVE-2020-12407

Verify integrity in audit chain (admin only). AS-IS.