CVE-2019-11741: XSS
A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these sites within the browser can potentially be used to modify a user's Firefox configuration. These two sites will now be isolated into their own process and not allowed to be loaded in a standard content process.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11741?
CVE-2019-11741 is a vulnerability that allows a compromised sandboxed content process to perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process.
How does CVE-2019-11741 affect Mozilla Firefox?
CVE-2019-11741 affects Mozilla Firefox versions up to and exclusive of 69.
What is the severity of CVE-2019-11741?
CVE-2019-11741 has a severity rating of high (7).
How can I fix CVE-2019-11741?
To fix CVE-2019-11741, update Mozilla Firefox to version 69 or newer.
Where can I find more information about CVE-2019-11741?
You can find more information about CVE-2019-11741 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1539595) and the Mozilla Security Advisories page (https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/).