CVE-2019-11697 - If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation

Back Back to CVE browser

MEDIUM

If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation

Published Jul 23, 2019

6.5

MEDIUM

CVSS 3.0

EPSS 0.85%

Description

If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <67

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<67

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=1440079
x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1440079		x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/		x_refsource_MISCVendor Advisory