CVE-2019-11716

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed. This vulnerability affects Firefox < 68.

Metrics

CVSS 3.0 8.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, all CVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream CVE-2019-117197.5When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Netw CVE-2019-11724.3An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An CVE-2019-117206.1Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This a CVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks a CVE-2019-117237.5A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. Thi CVE-2019-117246.1Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redi CVE-2019-117256.5When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but res CVE-2019-117275.3A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when CVE-2019-117284.7The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a us CVE-2019-117297.5Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into mem