What’s Vulnerable › Vulnerabilities

CVE-2019-11741

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-27 · updated 2026-06-17
• Weakness: CWE-79

Description

A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these sites within the browser can potentially be used to modify a user's Firefox configuration. These two sites will now be isolated into their own process and not allowed to be loaded in a standard content process. This vulnerability affects Firefox < 69.

Affected products

• Mozilla Firefox: before 69.0 — fixed in 69.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 69.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1539595
• https://www.mozilla.org/security/advisories/mfsa2019-25/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1539595
• https://www.mozilla.org/security/advisories/mfsa2019-25/

Get alerted when CVE-2019-11741 or the next vulnerability affects your stack