CVE-2019-11748

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

• CWE-281

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1564588Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-25/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-26/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1564588Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-25/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-26/Vendor Advisory

Published

Sep 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11742A same-origin policy violation occurs allowing the theft of …6.5
• CVE-2019-11743Navigation events were not fully adhering to the W3C's "Navi…3.7
• CVE-2019-11744Some HTML elements, such as &lt;title&gt; and &lt;textarea&g…6.1
• CVE-2019-11745When encrypting with a block cipher, if a call to NSC_Encryp…8.8
• CVE-2019-11746A use-after-free vulnerability can occur while manipulating …8.8
• CVE-2019-11747The "Forget about this site" feature in the History pane is …6.5
• CVE-2019-11749A vulnerability exists in WebRTC where malicious web content…4.3
• CVE-2019-1175An elevation of privilege vulnerability exists in the way th…7
• CVE-2019-11750A type confusion vulnerability exists in Spidermonkey, which…6.5
• CVE-2019-11751Logging-related command line parameters are not properly san…8.8
• CVE-2019-11752It is possible to delete an IndexedDB key value and subseque…8.8
• CVE-2019-11753The Firefox installer allows Firefox to be installed to a cu…7.8