CVE-2019-11708

Mozilla Firefox ESR, Mozilla Firefox, Mozilla Thunderbird

Published 23 Jul 2019 · updated 17 Jun 2026 · Analyzed

10.0 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 23 May 2022, with a remediation deadline of 13 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

References

packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html · Third Party Advisory, VDB Entry
bugzilla.mozilla.org/show_bug.cgi?id=1559858 · Issue Tracking, Vendor Advisory
security.gentoo.org/glsa/201908-12 · Third Party Advisory
www.mozilla.org/security/advisories/mfsa2019-19/ · Vendor Advisory
www.mozilla.org/security/advisories/mfsa2019-20/ · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708 · US Government Resource