CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
Affected products
mozilla: firefox; mozilla: thunderbird
References10
- bugzilla.mozilla.org/show_bug.cgi?id=1559858 Issue TrackingVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-19/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1559858 Issue TrackingVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-19/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64… Third Party AdvisoryVDB Entry
- security.gentoo.org/glsa/201908-12 Third Party Advisory
- packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64… Third Party AdvisoryVDB Entry
- security.gentoo.org/glsa/201908-12 Third Party Advisory
Metrics
- CVSS 3.1
-
10.0
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 56% percentile: 99 · as of 10 November 2026
- CWE
- CWE-20
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.