CVE-2019-11742: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a &lt;canvas&gt; element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Affected products

• Mozilla Firefox: before 60.9.0 (fixed in 60.9.0); before 69.0 (fixed in 69.0)
• Mozilla Firefox ESR: from 68.0, before 68.1.0 (fixed in 68.1.0)
• Mozilla Thunderbird: before 60.9.0 (fixed in 60.9.0); from 68.0, before 68.1.0 (fixed in 68.1.0)

Published 2019-09-27. Last modified 2026-06-17.