CVE-2019-11696

7.8 highEPSS 0.8%

High (7.8) in mozilla firefox. EPSS 0.8% chance of exploitation in the next 30 days.

Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. This vulnerability affects Firefox < 67.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2019-07-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1392955
https://www.mozilla.org/security/advisories/mfsa2019-13/
https://bugzilla.mozilla.org/show_bug.cgi?id=1392955
https://www.mozilla.org/security/advisories/mfsa2019-13/

Check your stack JSON