CVE-2019-11743: Mozilla Firefox

Low severity, CVSS 3.7. EPSS: 1.8% chance of exploitation in the next 30 days.

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Affected products

• Mozilla Firefox: before 60.9.0 (fixed in 60.9.0); before 69.0 (fixed in 69.0)
• Mozilla Firefox ESR: from 68.0, before 68.1.0 (fixed in 68.1.0)
• Mozilla Thunderbird: before 60.9.0 (fixed in 60.9.0); from 68.0, before 68.1.0 (fixed in 68.1.0)

Published 2019-09-27. Last modified 2026-06-17.