Mozilla · Firefox and Thunderbird
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
What it is
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
CISA: Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 13, 2022
- Added to the CISA list
- May 23, 2022
- Published
- July 23, 2019
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 56% in the top 1.0% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (5)
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| Mar 28, 2022 | Denial-of-Service | Firefox and Thunderbird | High 8.8 | 69% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 3.0% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 7.1% |
| Nov 3, 2021 | Type Confusion | Firefox and Thunderbird | High 8.8 | 46% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.