CVE-2019-11744 - Mozilla: XSS by breaking out of title and textarea elements using innerHTML

Back Back to CVE browser

MEDIUM

Mozilla: XSS by breaking out of title and textarea elements using innerHTML

Published Sep 27, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.45%

Description

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <69
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <60.9
- Version
  unspecified
  Status
  affected
  Constraints
  <68.1
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <60.9
- Version
  unspecified
  Status
  affected
  Constraints
  <68.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<69

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<60.9
unspecified	affected	<68.1

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<60.9
unspecified	affected	<68.1

Red Hat Enterprise Linux 6

firefox-0:60.9.0-1.el6_10

Fixed · RHSA-2019:2694
Red Hat Enterprise Linux 6

thunderbird-0:60.9.0-1.el6_10

Fixed · RHSA-2019:2807
Red Hat Enterprise Linux 7

firefox-0:60.9.0-1.el7_7

Fixed · RHSA-2019:2729
Red Hat Enterprise Linux 7

thunderbird-0:60.9.0-1.el7_7

Fixed · RHSA-2019:2773
Red Hat Enterprise Linux 8

firefox-0:68.1.0-1.el8_0

Fixed · RHSA-2019:2663
Red Hat Enterprise Linux 8

thunderbird-0:60.9.0-2.el8_0

Fixed · RHSA-2019:2774
Red Hat Enterprise Linux 5

firefox

Out of support scope
Red Hat Enterprise Linux 5

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	firefox-0:60.9.0-1.el6_10	Fixed	RHSA-2019:2694
Red Hat Enterprise Linux 6	thunderbird-0:60.9.0-1.el6_10	Fixed	RHSA-2019:2807
Red Hat Enterprise Linux 7	firefox-0:60.9.0-1.el7_7	Fixed	RHSA-2019:2729
Red Hat Enterprise Linux 7	thunderbird-0:60.9.0-1.el7_7	Fixed	RHSA-2019:2773
Red Hat Enterprise Linux 8	firefox-0:68.1.0-1.el8_0	Fixed	RHSA-2019:2663
Red Hat Enterprise Linux 8	thunderbird-0:60.9.0-2.el8_0	Fixed	RHSA-2019:2774
Red Hat Enterprise Linux 5	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 5	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it may present a risk in browser-like contexts.

Metrics

1.45% 0.01450

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.01450

Score over time

2021-2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	1.45% (0.01450)	72.47th	v5 (v2026.06.15)
Jun 15, 2026	1.45% (0.01450)	69.86th	v5 (v2026.06.15)
Mar 30, 2025	0.79% (0.00786)	71.58th	v4 (v2025.03.14)
Mar 29, 2025	1.85% (0.01850)	71.92th	v4 (v2025.03.14)
Mar 17, 2025	0.79% (0.00786)	72.15th	v4 (v2025.03.14)
Dec 12, 2024	0.30% (0.00305)	70.58th	v3 (v2023.03.01)
Feb 8, 2024	0.27% (0.00266)	66.69th	v3 (v2023.03.01)
Sep 3, 2023	0.27% (0.00270)	63.70th	v3 (v2023.03.01)
Aug 1, 2023	0.24% (0.00236)	60.83th	v3 (v2023.03.01)
Mar 7, 2023	0.27% (0.00269)	62.60th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 23, 2023	1.54% (0.01537)	74.48th	v2 (v2022.01.01)
Apr 1, 2022	1.54% (0.01537)	72.41th	v2 (v2022.01.01)
Feb 4, 2022	11.61% (0.11613)	88.84th	v2 (v2022.01.01)
Feb 3, 2022	10.99% (0.10990)	88.00th	v1
Jan 6, 2022	10.99% (0.10990)	87.86th	v1
Sep 1, 2021	2.68% (0.02678)	79.35th	v1
Apr 14, 2021	2.68% (0.02678)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (17)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2019-11744
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1562033
x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1748655
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2019-11744
https://security.gentoo.org/glsa/201911-07
vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/4150-1/
vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2019-11744
https://www.mozilla.org/en-US/security/advisories/mfsa2019-27/#CVE-2019-11744
https://www.mozilla.org/security/advisories/mfsa2019-25/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-26/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-27/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-29/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-30/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2019-11744		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1562033		x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1748655		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2019-11744
https://security.gentoo.org/glsa/201911-07		vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/4150-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2019-11744
https://www.mozilla.org/en-US/security/advisories/mfsa2019-27/#CVE-2019-11744
https://www.mozilla.org/security/advisories/mfsa2019-25/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-26/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-27/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-29/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-30/		x_refsource_CONFIRMVendor Advisory