CVE-2019-11697

If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.

• CWE-20

• https://bugzilla.mozilla.org/show_bug.cgi?id=1440079Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1440079Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory

Published

Jul 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11691A use-after-free vulnerability can occur when working with X…
• CVE-2019-11692A use-after-free vulnerability can occur when listeners are …
• CVE-2019-11693The bufferdata function in WebGL is vulnerable to a buffer o…
• CVE-2019-11694A vulnerability exists in the Windows sandbox where an unini…
• CVE-2019-11695A custom cursor defined by scripting on a site can position …
• CVE-2019-11696Files with the .JNLP extension used for "Java web start" app…
• CVE-2019-11698If a crafted hyperlink is dragged and dropped to the bookmar…
• CVE-2019-11699A malicious page can briefly cause the wrong name to be high…
• CVE-2019-1170An elevation of privilege vulnerability exists when reparse …7.9
• CVE-2019-11700A hyperlink using the res: protocol can be used to open loca…
• CVE-2019-11701The default webcal: protocol handler will load a web site vu…
• CVE-2019-11702A hyperlink using protocols associated with Internet Explore…