ZeroDay Findings
Sign inSign up

Findings

CVE-2019-11708

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Published Jul 23, 2019 · updated Jun 16, 2026 · mozilla firefox

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 23, 2019 · Catalog

    Detected

    Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, a

  2. May 23, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 13, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, a

Required action

Apply updates per vendor instructions.

CISA due date Jun 13, 2022

Affected

  • cpe mozilla/firefoxversion unspecified
  • cpe mozilla/thunderbirdversion unspecified
  • vendor Mozilla Firefox and Thunderbirdversion unspecified

Sources

  • CISA KEVCVE-2019-11708

    Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

    cisa.gov
  • CVE.orgCVE-2019-11708

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-11708

    30-day exploitation probability 55.9%

    first.org
  • Exploit Database47752

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2019-11708

    Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result

    nvd.nist.gov

References