Riskcovery

CVE-2019-9812

State
Published
Severity
Not scored
Published
Jan 8, 2020
Updated
Aug 4, 2024
Reserved
Mar 14, 2019

Read the record on cve.org

Description

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Firefox ESRMozilla
  • before 60.9Affected
Firefox ESRMozilla
  • before 68.1Affected
FirefoxMozilla
  • before 69Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.