CVE-2019-11691

What it actually does

A use-after-free in XMLHttpRequest handling within an event loop allows the XHR object to be accessed after deallocation, leading to memory corruption and potential arbitrary code execution.

Why it matters to the business

Attackers could remotely crash or take control of users' browsers or email clients, leading to data theft or system compromise without user interaction beyond visiting a malicious site.

How an attack unfolds

An attacker crafts a malicious webpage that triggers specific XHR operations in a timing-sensitive manner within the event loop, causing the freed object to be reused, resulting in a crash that can be turned into code execution.

How to fix it

Upgrade Mozilla Firefox to version 67 or later, Firefox ESR to 60.7 or later, and Thunderbird to 60.7 or later.

How to confirm the fix worked

Verify installed versions are at or above the fixed releases; monitor for absence of crash reports related to XHR in affected versions.

Typical attack path

1. Craft malicious webpage with crafted XHR calls
2. Host on attacker-controlled site
3. Lure victim to visit the page
4. Trigger use-after-free via event loop timing
5. Exploit resulting memory corruption for code execution

How to detect it

Look for crash logs involving XMLHttpRequest in browser processes; check for unexpected process terminations or memory errors in Firefox/Thunderbird.

What your security team should do

• Prioritize updating all Firefox, ESR, and Thunderbird instances to patched versions
• Disable JavaScript if feasible in high-risk environments
• Monitor Mozilla advisories for related issues