CVE-2019-11697: Input Validation
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11697?
CVE-2019-11697 is a vulnerability in Mozilla Firefox that allows a malicious web page to install extensions without user consent.
What is the severity of CVE-2019-11697?
CVE-2019-11697 has a severity score of 6.5, which is considered medium.
How can I fix CVE-2019-11697?
To fix CVE-2019-11697, update Mozilla Firefox to version 67.0 or higher.
Where can I find more information about CVE-2019-11697?
You can find more information about CVE-2019-11697 on the Mozilla website and the Bugzilla entry.
What is the CWE classification of CVE-2019-11697?
CVE-2019-11697 is classified as CWE-20, which is Improper Input Validation.