CVE-2019-17001: Mozilla Firefox

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70.

Affected products

• Mozilla Firefox: version 69.0 only

Published 2020-01-08. Last modified 2026-06-17.