CVE-2019-11697

MEDIUM

Firefox < 67.0 - Extension Installation Spoofing via Key Combination Bypass

Title source: llm
STIX 2.1

Description

If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.

References (2)

Core 2
Core References
Issue Tracking, Permissions Required, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1440079

Scores

CVSS v3 6.5
EPSS 0.0020
EPSS Percentile 42.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (1)
mozilla/firefox < 67.0
Published Jul 23, 2019
Tracked Since Feb 18, 2026