Back
CVE-2019-11748
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party…
Medium6.5EPSS 1.0%
- Published
- Updated
- Reserved
- Assigned by
- mozilla
Description
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.0% · top 36% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
- Persistence of WebRTC permissions in a third party context
- CWE-281 (opens in a new tab)All about CWE-281 and its CVEs
Affected products
- affected unspecified – < 69
- affected unspecified – < 68.1
References (5)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1564588 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.mozilla.org/security/advisories/mfsa2019-25/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.mozilla.org/security/advisories/mfsa2019-26/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- openSUSE-SU-2019:2251 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2019:2260 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-11748)Record last updated .