CVE-2019-11718: Mozilla Firefox

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.

Affected products

• Mozilla Firefox: before 68.0 (fixed in 68.0)
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-07-23. Last modified 2026-06-17.