CVE-2019-11761: Canonical Ubuntu Linux

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Affected products

• Canonical Ubuntu Linux: version 16.04 only
• Mozilla Firefox: before 70.0 (fixed in 70.0)
• Mozilla Firefox ESR: before 68.2 (fixed in 68.2)
• Mozilla Thunderbird: before 68.2 (fixed in 68.2)

Published 2020-01-08. Last modified 2026-06-17.