CVE-2020-6828

HIGH

Firefox ESR < 68.7.0 - Path Traversal and Arbitrary File Write via Malicious Android Intent

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-6828. PoCs published by slient2009.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2020-6828, targeting a path traversal vulnerability in Mozilla Firefox for Android. The exploit uses a malicious ContentProvider to overwrite Firefox's configuration files (profiles.ini and user.js) via directory traversal, redirecting traffic through a proxy.

Description

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.

Exploits (1)

github WORKING POC
by slient2009 · javapoc
https://github.com/slient2009/CVE-PoCs/tree/main/CVE-2020-6828

This repository contains a functional exploit PoC for CVE-2020-6828, targeting a path traversal vulnerability in Mozilla Firefox for Android. The exploit uses a malicious ContentProvider to overwrite Firefox's configuration files (profiles.ini and user.js) via directory traversal, redirecting traffic through a proxy.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Mozilla Firefox for Android (versions prior to 74)
No auth needed
Prerequisites: Android device with vulnerable Firefox installed · Ability to install a malicious APK
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (2)

Core 2
Core References
Issue Tracking, Permissions Required x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1617928

Scores

CVSS v3 7.5
EPSS 0.0147
EPSS Percentile 70.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-22
Status published
Products (1)
mozilla/firefox_esr < 68.7.0
Published Apr 24, 2020
Tracked Since Feb 18, 2026