CVE-2019-11708 is a critical vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird, where insufficient parameter vetting in the Prompt:Open IPC message allows a compromised child process to force the non-sandboxed parent process to open attacker-controlled web content. This flaw, when chained with other vulnerabilities, can lead to arbitrary code execution on the user's system. With a CVSS score of 10.0 (Critical), it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, as confirmed by its presence in the KEV catalog and documented full-chain client-side attacks, garnering significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 60.7.2CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* | ||
< 67.0.4CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* | ||
< 60.7.2CPE matchmatch criteria | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.