CVE-2019-9803

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98049.8In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the CVE-2019-98059.8A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential CVE-2019-98067.5A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immedia CVE-2019-98074.3When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this CVE-2019-98085.3If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originat CVE-2019-98097.5If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these res CVE-2019-98108.8Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflo CVE-2019-98118.3As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a br CVE-2019-98129.3Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.fir CVE-2019-98138.8Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read an CVE-2019-98149.8Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory cor CVE-2019-98158.1If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.