CVE-2019-11744: XSS
Last updated 25 August 2025
Other sources
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
— MITRE
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60.9 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 68.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 69 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.9 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 147.0.4-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 140.7.0esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.8.0esr-1~deb12u1Fixed in 140.4.0esr-1~deb13u1Fixed in 140.8.0esr-1~deb13u1Fixed in 140.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 69.9.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 68.1.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-11739
- CVE-2019-11746
- CVE-2019-11744
- CVE-2019-11742
- CVE-2019-11752
- CVE-2019-11743
- CVE-2019-11740
- CVE-2019-11751
- CVE-2019-11736
- CVE-2019-11753
- CVE-2019-9812
- CVE-2019-11748
- CVE-2019-11749
- CVE-2019-11750
- CVE-2019-11738
- CVE-2019-11747
- CVE-2019-11735
- CVE-2019-11741
- CVE-2019-5849
- CVE-2019-11737
- CVE-2019-11734
- CVE-2019-11758
Frequently Asked Questions
What is CVE-2019-11744?
CVE-2019-11744 is a vulnerability in HTML elements such as <title> and <textarea> that allows for the injection of malicious code, leading to potential XSS attacks.
What software products are affected by CVE-2019-11744?
CVE-2019-11744 affects Mozilla Firefox ESR versions up to 68.1, Mozilla Firefox versions up to 69, Mozilla Thunderbird versions up to 60.9, and Mozilla Thunderbird ESR versions up to 68.1.
How severe is CVE-2019-11744?
CVE-2019-11744 is considered to be a high severity vulnerability with a severity score of 7.
What is the Common Weakness Enumeration (CWE) for CVE-2019-11744?
The CWE for CVE-2019-11744 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can CVE-2019-11744 be mitigated?
To mitigate CVE-2019-11744, users should update their affected software to the latest versions provided by Mozilla.