CVE-2019-11708: Mozilla Firefox and Thunderbird sandbox escape via Prompt:Open IPC validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no privileges or user interaction, scope change, and confirmed KEV exploitation make this a top remediation priority.

What it is

The Prompt:Open IPC message between child and parent processes does not sufficiently vet its parameters, letting a compromised child process cause the non-sandboxed parent to open web content of the attacker's choosing. This breaks the browser sandbox boundary, and when chained with other bugs it can lead to arbitrary code execution on the host. Firefox ESR before 60.7.2, Firefox before 67.0.4, and Thunderbird before 60.7.2 are affected.

Impact

An attacker who already controls a sandboxed child process can escape the sandbox and have the privileged parent load attacker-chosen content, enabling arbitrary code execution on the user's machine when combined with additional vulnerabilities.

Attack surface

Reached over the network with no privileges and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it depends on first compromising a child process, so it is a sandbox-escape step rather than a standalone entry point.

Exploitation

It is listed in CISA KEV with a 2022-05-23 addition and a 2022-06-13 remediation due date, and EPSS shows a 30-day probability of 0.55874 (98.99th percentile); a public third-party exploit chain reference exists, though no ransomware campaign use is documented.

What to do

• Update Firefox to 67.0.4 or later, Firefox ESR to 60.7.2 or later, and Thunderbird to 60.7.2 or later per Mozilla advisories mfsa2019-19 and mfsa2019-20.
• Apply the vendor updates within the CISA KEV due date if any affected version is still deployed.
• Inventory endpoints and confirm no Firefox ESR, Firefox, or Thunderbird builds remain below the fixed versions.
• Apply the Gentoo GLSA 201908-12 update if the distribution package is used.
• Reduce exposure by enforcing current browser versions through managed update policy.

Detection

• Hunt for Firefox, Firefox ESR, or Thunderbird versions below 60.7.2 or 67.0.4 in asset and software inventory.
• Monitor for browser child processes spawning unexpected parent or system processes, which may indicate sandbox escape chaining.
• Review endpoint telemetry for suspicious content loads or code execution originating from the browser parent process.
• Track CISA KEV status and EPSS score for this CVE as a prioritization signal in vulnerability management.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.