Skip to content
Fencer Vulns
medium 6.5

CVE-2019-11765 json

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.

published 2020-01-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-3435

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. This vulnerability affects Firefox < 70.

Patch / fix

  • mozilla firefox 70.0
  • firefox Ubuntu 16.04 LTS 70.0+build2-0ubuntu0.16.04.1
  • firefox Ubuntu 18.04 LTS 70.0+build2-0ubuntu0.18.04.1
  • firefox Ubuntu 20.04 LTS 70.0+build2-0ubuntu1

ubuntu advisories UBUNTU-CVE-2019-11765

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1

  • firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +9 more 70.0-r0
  • librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 70.0-r0

alpine advisories ALPINE-CVE-2019-11765

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox Arch Linux 70.0-1

arch linux advisories AVG-1055

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.