HackerFeeds
All CVEs

CVE-2019-11708

CRITICAL10.0
CISA KEV

Published 2019-07-23 · Updated 2026-06-17 · Source security@mozilla.org

Summary

CVE-2019-11708 is a critical-severity (CVSS 10.0) vulnerability in Mozilla Firefox and Thunderbird. CISA added it to the Known Exploited Vulnerabilities catalog on May 23, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 13, 2022. CISA does not currently list it as used in ransomware campaigns. Mozilla has 13 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.

All 13 known-exploited Mozilla vulnerabilities →

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-20CWE-20

CISA Known-Exploited Vulnerability

Product: Mozilla — Firefox and Thunderbird

Name: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Date added: 2022-05-23 · Due: 2022-06-13

Required action: Apply updates per vendor instructions.

References

View on NVD