CVE-2019-9801

Mozilla: Windows programs that are not 'URL Handlers' are exposed to web content

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.0

Review impact separately from score.

Published · March 20, 2019

Updated · November 22, 2025

Description

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Statement

This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 6 and 7.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')