CVE-2019-11711

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 60.8
MozillaFirefox>= unspecified, < 68
MozillaThunderbird>= unspecified, < 60.8

References

Timeline

Published
Jul 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117128.8POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allowCVE-2019-117139.8A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially explCVE-2019-117149.8Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vuCVE-2019-117156.1Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards onCVE-2019-117168.3Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropeCVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allCVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream CVE-2019-117197.5When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the NetwCVE-2019-11724.3An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An CVE-2019-117206.1Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This aCVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks aCVE-2019-117237.5A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. Thi
CVE-2019-11711: High severity, CVSS 8.8 | Vulnix