CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Q: How do I fix CVE-2019-11708?

firefox: upgrade to 60.7.2, 67.0.4; thunderbird: upgrade to 60.7.2. Exact commands for each OS are on this page.

Q: Is CVE-2019-11708 being exploited?

Yes. CVE-2019-11708 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2019-11708 affect?

CVE-2019-11708 affects firefox, thunderbird. Severity is critical (CVSS 10.0). Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with addit

Q: How urgent is CVE-2019-11708?

Priority 95/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; Remotely exploitable, no login, no user action

Patch now

CRITICAL 10.0EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2019-11708 is a critical-severity flaw (CVSS 10.0) affecting firefox, thunderbird, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	55.9% (top 1%)
CISA exploited list	Yes, fix due 2022-06-13
Weakness	CWE-20
Published	2019-07-23
Last modified	2026-06-17

Publisher (CNA): Mozilla Corporation · Vendor: mozilla

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-07-23 14:15 UTCPublished CVE record published
2022-05-23Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-06-13Deadline CISA due date for US federal agencies to patch
2026-06-17 02:13 UTCUpdated Record last modified

mozilla firefox UPGRADE

Affected: < 60.7.2 · < 67.0.4

Fixed in: 60.7.2, 67.0.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy firefox || rpm -q firefox || firefox --version

2. UPGRADE to 60.7.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade firefox

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade firefox

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

mozilla thunderbird UPGRADE

Affected: < 60.7.2

Fixed in: 60.7.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version

2. UPGRADE to 60.7.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade thunderbird

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade thunderbird

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · python-discovery · FIXED · 1.9.0-1.eln159 · FEDORA-2026-7a881c0c99 · source

sudo dnf upgrade --advisory=FEDORA-2026-7a881c0c99

Fedora 46 · pipx · FIXED · 1.18.11-1.fc46 · FEDORA-2026-443a765287 · source

sudo dnf upgrade --advisory=FEDORA-2026-443a765287

Debian 12 · firefox-esr · FIXED · 60.7.2esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "60.7.2esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · firefox-esr · FIXED · 60.7.2esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "60.7.2esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · thunderbird · FIXED · 1:60.7.2-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:60.7.2-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · thunderbird · FIXED · 1:60.7.2-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:60.7.2-1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 6 · firefox · FIXED · firefox-60.7.2-1.el6_10

sudo dnf upgrade --advisory=RHSA-2019:1604 rpm -q firefox

RHEL 6 · thunderbird · FIXED · thunderbird-60.7.2-2.el6_10

sudo dnf upgrade --advisory=RHSA-2019:1624 rpm -q thunderbird

RHEL 7 · firefox · FIXED · firefox-60.7.2-1.el7_6

sudo dnf upgrade --advisory=RHSA-2019:1603 rpm -q firefox

RHEL 7 · thunderbird · FIXED · thunderbird-60.7.2-2.el7_6

sudo dnf upgrade --advisory=RHSA-2019:1626 rpm -q thunderbird

RHEL 8 · thunderbird · FIXED · thunderbird-60.7.2-2.el8_0

sudo dnf upgrade --advisory=RHSA-2019:1623 rpm -q thunderbird

Alpine 3.20 · firefox-esr · FIXED · firefox-esr-60.7.2-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.21 · firefox-esr · FIXED · firefox-esr-60.7.2-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.22 · firefox-esr · FIXED · firefox-esr-60.7.2-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.23 · firefox-esr · FIXED · firefox-esr-60.7.2-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Amazon Linux 2 · see advisory · FIXED · ALAS2-2019-1250 · source

sudo yum update --advisory=ALAS2-2019-1250

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: 0vercl0k/CVE-2019-11708 (626 stars)
Exploit-DB: Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-11708?

firefox: upgrade to 60.7.2, 67.0.4; thunderbird: upgrade to 60.7.2. Exact commands for each OS are on this page.

Is CVE-2019-11708 being exploited?

Yes. CVE-2019-11708 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2019-11708 affect?

CVE-2019-11708 affects firefox, thunderbird. Severity is critical (CVSS 10.0). Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with addit

How urgent is CVE-2019-11708?

Priority 95/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; Remotely exploitable, no login, no user action

Software pages

Mozilla Firefox vulnerabilities · Mozilla Thunderbird vulnerabilities

Related CVEs

CVE-2026-74990 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74989 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox 153
CVE-2026-74988 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 153.0 and Firefox 153
CVE-2026-74987 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74969 HIGH 8.8 UPGRADE UPGRADE Race condition, use-after-free in the Layout: Text and Fonts component

References

← Back to latest CVEs