CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Description
CVE-2019-11708 is a sandbox escape vulnerability in Mozilla Firefox and Thunderbird that could result in remote code execution outside the browser's sandboxed content process. By exploiting insufficient validation of parameters passed via inter-process communication (IPC), an attacker can break out of the content process sandbox and execute code with the privileges of the parent process. CISA has confirmed active exploitation of CVE-2019-11708 and included it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 98.6%, this vulnerability is highly exploited, particularly when chained with CVE-2019-11707 for full system compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 60.7.2; < 67.0.4 |
| mozilla | thunderbird | < 60.7.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html(Third Party Advisory, VDB Entry)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1559858(Issue Tracking, Vendor Advisory)
- https://security.gentoo.org/glsa/201908-12(Third Party Advisory)
- https://www.mozilla.org/security/advisories/mfsa2019-19/(Vendor Advisory)
- https://www.mozilla.org/security/advisories/mfsa2019-20/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708(US Government Resource)
Weakness Type
CWE-250: Execution with Unnecessary Privileges
CWE-250 describes a weakness where a product performs an operation at a privilege level higher than the minimum required, creating a larger attack surface. In CVE-2019-11708, insufficient validation of IPC messages between Firefox's sandboxed content process and the privileged parent process allows an attacker to escape the sandbox and execute code with elevated privileges that should not be accessible from within the content process.
Learn more: CWE-250 — Execution with Unnecessary Privileges
Impact Analysis
CVE-2019-11708 is a sandbox escape vulnerability that allows an attacker to break out of Firefox's content process sandbox and execute code with the full privileges of the browser's parent process. This effectively nullifies the security boundary that Firefox's multi-process architecture is designed to enforce. When chained with a content process code execution vulnerability such as CVE-2019-11707, the combined attack achieves unrestricted code execution on the host system — the attacker can install malware, steal credentials, access files, and maintain persistent access. The EPSS percentile of 98.6% indicates extremely high exploitation activity. The impact extends to Thunderbird as well, meaning email-delivered exploits can also leverage this sandbox escape. The vulnerability is particularly severe because sandbox escapes are relatively rare and highly valued in the exploit ecosystem, as they represent the final barrier between browser compromise and full system compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-11708 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 98.6% reflects extensive real-world exploitation. Mozilla confirmed that CVE-2019-11708 was exploited as a zero-day in conjunction with CVE-2019-11707 in targeted attacks against cryptocurrency companies. The attack chain was sophisticated: CVE-2019-11707 (type confusion) provided initial code execution within the sandboxed content process, while CVE-2019-11708 allowed the attacker to escape the sandbox and achieve full system-level access. This combination of a renderer bug with a sandbox escape is characteristic of state-level or advanced persistent threat operations. The targeted nature of the campaign — focusing on cryptocurrency industry personnel — indicates high-value target selection by the threat actors.
Remediation
- Update Mozilla Firefox to version 67.0.4 or later and Firefox ESR to version 60.7.2 or later. Update Thunderbird to version 60.7.2 or later. These versions contain the official fix for CVE-2019-11708.
- Enable automatic updates in all Mozilla products to ensure rapid deployment of security patches. Enterprise environments should use configuration management to enforce minimum version compliance.
- Implement network segmentation and endpoint isolation for high-value workstations, particularly those used by personnel in the cryptocurrency or financial sectors who may be targeted by sophisticated attacks leveraging this vulnerability.
- Deploy endpoint detection and response (EDR) solutions capable of detecting sandbox escape behavior, including unusual child process creation from browser processes and unexpected privilege escalation patterns.
- Consider deploying browser isolation solutions that run browser processes in disposable virtual environments, providing an additional containment layer even if the browser's built-in sandbox is compromised.
Technical Details
CVE-2019-11708 is a sandbox escape vulnerability in Mozilla Firefox and Thunderbird that exploits insufficient validation of Prompt:Open IPC messages between the sandboxed content process and the privileged parent (chrome) process. Firefox uses a multi-process architecture where web content runs in sandboxed content processes with restricted system access, while the parent process retains full privileges. Communication between these processes occurs via IPC messages. The vulnerability exists because the parent process does not adequately validate certain parameters received from the content process via IPC, specifically related to the Prompt:Open message type. An attacker who has already achieved code execution in the content process (for example, via CVE-2019-11707) can send a specially crafted IPC message that causes the parent process to perform operations that should not be allowed from the content process context. This effectively allows the attacker to escape the sandbox and execute arbitrary code with the full privileges of the parent process, which runs outside the sandbox with the user's system-level permissions.
Frequently Asked Questions
Is CVE-2019-11708 being actively exploited?
Yes, CVE-2019-11708 was exploited as a zero-day in targeted attacks against cryptocurrency companies, chained with CVE-2019-11707. CISA has included it in the KEV catalog, and its EPSS percentile of 98.6% confirms extremely high exploitation activity.
What products are affected by CVE-2019-11708?
CVE-2019-11708 affects Mozilla Firefox (before version 67.0.4), Firefox ESR (before 60.7.2), and Mozilla Thunderbird (before 60.7.2). The vulnerability resides in the IPC mechanism shared across these products.
How do I fix CVE-2019-11708?
Update Firefox to version 67.0.4+, Firefox ESR to 60.7.2+, or Thunderbird to 60.7.2+. Enable automatic updates and deploy EDR solutions capable of detecting sandbox escape behavior from browser processes.
How severe is CVE-2019-11708?
CVE-2019-11708 is a critical sandbox escape vulnerability with an EPSS percentile of 98.6%. Sandbox escapes are among the most severe browser vulnerabilities because they defeat the primary security boundary protecting the host system. When combined with CVE-2019-11707, it enables complete system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.