CVE-2019-11746: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Affected products

• Mozilla Firefox: before 60.9.0 (fixed in 60.9.0); before 69.0 (fixed in 69.0)
• Mozilla Firefox ESR: from 68.0, before 68.1.0 (fixed in 68.1.0)
• Mozilla Thunderbird: before 60.9.0 (fixed in 60.9.0); from 68.0, before 68.1.0 (fixed in 68.1.0)

Published 2019-09-27. Last modified 2026-06-17.