CVE-2019-11723

critical

Published — · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

9.5

Description

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-11723

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201907-4

OS impact

OS	Version	Status	Fixed in
arch		fixed	`68.0-1`
debian	sid	fixed	`68.0-1`

References

https://security.archlinux.org/ASA-201907-4
https://security-tracker.debian.org/tracker/CVE-2019-11723

Verify integrity in audit chain (admin only). AS-IS.