CVE-2019-11695
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area.
Does this matter?
Lower severity and a low EPSS score (0.74%). Track it; it rarely justifies an emergency change on its own.
Description
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. This vulnerability affects Firefox < 67.
- CVSS 3.0
- 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.74% probability · 52th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1445844Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1445844Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.