CVE-2019-11752: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Affected products

• Mozilla Firefox: before 60.9.0 (fixed in 60.9.0); before 69.0 (fixed in 69.0)
• Mozilla Firefox ESR: from 68.0, before 68.1.0 (fixed in 68.1.0)
• Mozilla Thunderbird: before 60.9.0 (fixed in 60.9.0); from 68.0, before 68.1.0 (fixed in 68.1.0)

Published 2019-09-27. Last modified 2026-06-17.