CVE-2019-11754

What it actually does

Website can activate pointer lock via requestPointerLock without any user-visible notification or permission prompt, allowing silent capture and redirection of mouse input.

Why it matters to the business

Users on unpatched browsers may be tricked into performing unintended clicks or actions on malicious sites, increasing risk of phishing success or unauthorized account activity with no visible warning.

How an attack unfolds

Attacker hosts a page that immediately calls requestPointerLock on load; the browser grants the lock with no UI indication, enabling the page to intercept and spoof mouse position and clicks to guide the user into interacting with attacker-controlled elements.

How to fix it

Upgrade Mozilla Firefox to version 69.0.1 or later on all endpoints.

How to confirm the fix worked

Confirm Firefox version is 69.0.1 or newer via about:support or enterprise inventory; test that pointer lock now triggers the standard notification UI.

Typical attack path

1. User visits attacker-controlled website
2. Page invokes requestPointerLock without user gesture or notification
3. Browser silently enables pointer lock
4. Attacker script manipulates cursor feedback and captures or redirects clicks
5. User performs actions believing the pointer is in a different location

How to detect it

Review browser history and proxy logs for visits to suspicious domains around the time of reported incidents; pointer lock usage itself leaves no persistent artifact in standard logs.

What your security team should do

• Prioritize browser updates across the fleet within standard patching windows
• Enable automatic updates for Firefox where policy permits
• Monitor EPSS and exploit maturity for any future increase in risk