CVE-2019-11744: XSS
Last updated 25 August 2025
Other sources
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
— MITRE
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-11739
- CVE-2019-11746
- CVE-2019-11744
- CVE-2019-11742
- CVE-2019-11752
- CVE-2019-11743
- CVE-2019-11740
- CVE-2019-11751
- CVE-2019-11736
- CVE-2019-11753
- CVE-2019-9812
- CVE-2019-11748
- CVE-2019-11749
- CVE-2019-11750
- CVE-2019-11738
- CVE-2019-11747
- CVE-2019-11735
- CVE-2019-11741
- CVE-2019-5849
- CVE-2019-11737
- CVE-2019-11734
- CVE-2019-11758
Frequently Asked Questions
What is CVE-2019-11744?
CVE-2019-11744 is a vulnerability in HTML elements such as <title> and <textarea> that allows for the injection of malicious code, leading to potential XSS attacks.
What software products are affected by CVE-2019-11744?
CVE-2019-11744 affects Mozilla Firefox ESR versions up to 68.1, Mozilla Firefox versions up to 69, Mozilla Thunderbird versions up to 60.9, and Mozilla Thunderbird ESR versions up to 68.1.
How severe is CVE-2019-11744?
CVE-2019-11744 is considered to be a high severity vulnerability with a severity score of 7.
What is the Common Weakness Enumeration (CWE) for CVE-2019-11744?
The CWE for CVE-2019-11744 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can CVE-2019-11744 be mitigated?
To mitigate CVE-2019-11744, users should update their affected software to the latest versions provided by Mozilla.