CVE-2019-11765

6.5 mediumEPSS 0.8%

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. This vulnerability affects Firefox < 70.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2020-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1562582
https://www.mozilla.org/security/advisories/mfsa2019-34/
https://bugzilla.mozilla.org/show_bug.cgi?id=1562582
https://www.mozilla.org/security/advisories/mfsa2019-34/

Check your stack JSON