CVE-2019-11708

What is Firefox's sandbox?

Firefox isolates the process that parses and renders untrusted web content from the rest of the operating system using an OS-level sandbox, so that even if an attacker achieves code execution inside the content process (for example via a JavaScript engine bug), that code should be unable to touch the filesystem, spawn processes, or otherwise act with the user's full privileges. A flaw that lets code escape this sandbox removes that last line of defense, turning a contained renderer bug into full control of the victim's machine.

Overview

CVE-2019-11708 is a sandbox escape vulnerability in Firefox and Thunderbird that lets code already running in the content process — for example, via exploitation of a separate memory-corruption bug like CVE-2019-11707 — break out of the browser's process sandbox and execute code with the broader privileges of the user running Firefox. It was discovered and patched within days of CVE-2019-11707 specifically because the two were used together in a real-world attack: the type confusion bug provided initial code execution inside the content process, and this bug provided the escape needed to gain full control of the host.

Technical Details

The vulnerability (CWE-20, improper input validation) resides in how Firefox's inter-process communication (IPC) between the content process and the privileged parent process validates certain messages, allowing content-process code to trigger unintended, higher-privileged actions in the parent process — such as opening a new, unsandboxed window/process that inherits the ability to interact with the operating system more broadly. Combined with an initial-access primitive like CVE-2019-11707, this let attackers escape the sandbox entirely and achieve remote code execution as the logged-in user, which is why the CVSS scoring marks it as maximum severity with a scope change (S:C).

Discovery

This bug came to light as part of the same investigation into the Coinbase-targeting spear-phishing campaign that surfaced CVE-2019-11707; researchers examining the full exploit chain identified this second, previously-unknown sandbox-escape bug, and Mozilla shipped a fix within roughly 48 hours of the initial disclosure.

Exploitation Context

Like its paired vulnerability, this bug was used in the wild before a patch existed, specifically as the second stage of a targeted attack against employees of a cryptocurrency exchange, loosely attributed by researchers and commentators at the time to North Korea-linked threat activity. It is a textbook example of a sandbox-escape bug being reserved for use only alongside a renderer-exploitation primitive, rather than being independently exploitable.

Remediation

1. Update Firefox to 67.0.4 or later (and Firefox ESR to 60.7.2 or later), and Thunderbird to a version incorporating the fix.
2. Apply this patch together with the fix for CVE-2019-11707 — the two must both be addressed since they were used as a combined exploit chain.
3. Keep browser auto-update enabled to minimize exposure windows for emergency zero-day fixes like this one.
4. For high-risk users (finance, cryptocurrency, executives, and other spear-phishing targets), reinforce email and link-click training given this bug's history of use in targeted campaigns.
5. Consider defense-in-depth controls (endpoint detection, application allow-listing) that can catch anomalous process creation even if a browser sandbox escape succeeds.