CVE-2019-11708 | Insufficient vetting of parameters passed with the Prompt:Op… | CVSS 10.0 CRITICAL

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

Metadata

CVE ID: CVE-2019-11708
State: PUBLISHED
Assigner: mozilla
Reserved: 2019-05-03 00:00 UTC
Published: 2019-07-23 13:20 UTC
Last updated: 2025-10-21 23:45 UTC
Primary CWE: CWE-20
CWE-20 Improper Input Validation
Vendor / Product: Mozilla / Firefox ESR
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: no
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Vendor: Mozilla
Product: Firefox and Thunderbird
Added to KEV: 2022-05-23
Due date: 2022-06-13
Ransomware: Not known

Required action

Apply updates per vendor instructions.

CISA description

Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

Affected products (3)

Vendor	Product	Platform	Versions
Mozilla	Firefox	—	unspecified < 67.0.4
Mozilla	Firefox ESR	—	unspecified < 60.7.2
Mozilla	Thunderbird	—	unspecified < 60.7.2

Weakness (CWE)

CWE	Source	Description
—	cna	sandbox escape using Prompt:Open
CWE-20	adp	CWE-20 Improper Input Validation

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (5)