PT-2019-4557 · Mozilla+3 · Firefox+3
Chris Hacking
·
Published
2019-07-09
·
Updated
2024-12-12
·
CVE-2019-11716
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 68
Description
The issue is related to the window.globalThis component in the Firefox browser, which is associated with an error in Object.getOwnPropertyNames(window). This error allows an attacker to bypass the isolated programming environment. Exploitation of this issue can enable a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem arises because window.globalThis is not enumerable until explicitly accessed by a script, making it invisible to certain code, such as Object.getOwnPropertyNames(window). This can lead to sandboxes being bypassed in sites that rely on enumerating and freezing access to the window object.
Recommendations
For Firefox versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting access to the window object to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Suse
Ubuntu