Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
74.0.1+build1-0ubuntu0.16.04.11:68.7.0+build1-0ubuntu0.16.04.274.0.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.175.0+build3-0ubuntu11:68.7.0+build1-0ubuntu1Exploitability
AV:NAC:HPR:NUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H